The Yoba malware campaign distributes cryptocurrency mining malware by abusing digitally signed AI application executables from OpenAI and Anthropic to evade detection. It uses DLL sideloading with malicious DLLs loaded alongside legitimate signed binaries. The infection chain includes YobaDropper and YobaLoader components that employ anti-analysis techniques such as process verification, execution delays, and regional language exclusions. Command and control communication uses Telegram profile images, domain generation algorithms, DNS over HTTPS via Google, and public hosting services to retrieve encrypted payloads. While primarily observed deploying the XMRig miner, the loader architecture can support additional Windows executables and PowerShell payloads, indicating potential expansion beyond cryptojacking.
An autonomous offensive agent named 'Skynet' hijacks exposed large language model (LLM) endpoints on the internet to conduct a range of attacks. It uses 74 offensive tools targeting web frameworks, credential theft, database access, and cryptocurrency mining. The agent operates unattended for extended periods by bypassing AI safety controls through jailbreak techniques. Victims include AI model owners who incur costs for computing power and compromised servers exploited for Monero mining. This activity was observed via an AI honeypot capturing the full attack sequence, highlighting a novel self-directed cybercrime targeting unauthenticated internet-facing AI services.
In Q3 2026, attackers targeted Windows-based MS-SQL and MySQL database servers using brute-force, dictionary attacks, and vulnerability exploitation. They deployed cryptocurrency miners (XMRig), backdoors (GotoHTTP), SoftEther VPN infrastructure, and various web shells for persistence. Additional tools included VShell for remote command execution, HackBrowserData for credential theft, Fscan for reconnaissance, and Cloudflared for port exposure. Attackers created backdoor RDP accounts and used SoftEther VPN servers as command and control infrastructure. The attacks mainly exploited weak passwords, poor account management, and insufficient security on exposed database servers.
Since April 2026, the PoeLLM malware campaign has targeted exposed AI/LLM and open-source services such as LiteLLM, Ollama, Gotenberg, and Gitea. It uses a novel command-and-control method where infected systems extract C2 server addresses from keywords embedded in a poem on GitHub. The malware deploys cryptocurrency miners (XMRig and Iron) connecting victims to Kryptex mining infrastructure. Compromised hosts are also used as scanners and exploit servers to grow the botnet, which has affected over 3,400 servers with up to 800 active daily. The campaign is linked to an Italian-speaking threat actor and mainly impacts victims in the United States and Western Europe. Vulnerable routers are exploited to serve as C2 infrastructure.
A sophisticated multi-stage infection chain was discovered through analysis of a system exhibiting frequent PowerShell execution alerts. The attack leveraged multiple layers of obfuscation and concealment techniques, including Registry-based payload storage, DNS TXT record exploitation, and data hidden within image and WAV audio files. The threat actors employed various evasion methods such as security control tampering and in-memory execution to avoid detection. Rather than writing payloads directly to disk, attackers reconstructed malicious code from distributed sources including Registry entries and steganographically encoded data in media files. The ultimate objective of this elaborate infection chain was to deploy cryptocurrency mining operations covertly on compromised systems while maintaining persistent access through multiple redundant mechanisms.
A sophisticated backdoor disguised as a legitimate Malwarebytes installer was distributed to over 100,000 machines through compromised automatic updates of one torrent client (Download Studio) and three adblockers (NetShield Kit, My AdBlock, and Net AdBlock). The backdoor creates a fake Malwarebytes installation directory containing legitimate signed files alongside malicious DLL files. Once executed, it establishes persistence through a Windows service and communicates with command-and-control servers to receive configuration updates and additional payloads. The primary observed payloads were cryptocurrency miners, though the infrastructure supports delivery of multiple persistent threats. The attack demonstrates abuse of software update mechanisms and affects primarily users in Russia, Ukraine, and Kazakhstan.
Aeternum is a C++ botnet loader utilizing the Polygon blockchain for command-and-control infrastructure instead of traditional centralized servers. Threat actors write encrypted and plaintext instructions directly to smart contracts, which infected devices query via public RPC endpoints. The malware implements weak PBKDF2HMAC/AES-GCM encryption with self-salting passwords, allowing payload decryption using only the smart contract address. Analysis reveals three related samples: the core Aeternum loader with Telegram-based exfiltration, a blended threat combining XWorm RAT with XMRig cryptocurrency miner, and Python source code revealing anti-analysis checks and cryptocurrency wallet targeting. The botnet demonstrates resilience through decentralized infrastructure, making traditional law enforcement takedowns significantly more challenging while maintaining low operational costs for attackers.
GhostGrab is a sophisticated Android malware that combines cryptocurrency mining with extensive data theft, targeting sensitive financial information such as banking credentials, debit card details, and OTPs. It exploits device resources for mining while maintaining persistence through advanced hiding techniques and resisting removal. The malware abuses permissions to access SMS, calls, and storage, enabling comprehensive data exfiltration. It uses Firebase for command-and-control and data exfiltration, masking malicious activity within legitimate cloud traffic. Its modular design includes WebView-based phishing pages aimed at financial fraud and identity theft. The malware infrastructure involves recently registered domains and obfuscation services, indicating a professional operation. GhostGrab exemplifies the convergence of financial cybercrime and resource exploitation in mobile malware, posing a significant threat to Android users. European organizations with mobile banking users are at risk, especially where Android market share is high. Mitigation requires enhanced mobile security controls, user awareness, and network monitoring for suspicious Firebase traffic.
Blitz is a new Windows-based malware discovered in 2024 consisting of a downloader and bot payload. The latest version was spread through backdoored game cheats for Standoff 2 distributed via Telegram. Blitz abuses Hugging Face Spaces to host components of its C2 infrastructure and payloads. The malware performs information stealing and DDoS attacks. An XMRig cryptocurrency miner was also deployed as follow-up malware. By May 2025, the developer claimed to have abandoned the project. Russia accounted for the highest number of infections among 289 victims across 26 countries. Palo Alto Networks customers are protected through various security products and services.
A series of attacks targeting Korean Internet cafés have been identified, focusing on systems with specific management software installed. The threat actor, active since 2022, uses Gh0st RAT for system control and ultimately installs T-Rex CoinMiner for cryptocurrency mining. The initial access method remains unknown. The attacks involve memory patching of management software and use of downloaders. The malware suite includes Gh0st RAT, its droppers, patchers, downloaders, and T-Rex CoinMiner. Unlike typical coin mining operations using XMRig for Monero, this actor employs T-Rex, likely due to the presence of high-performance GPUs in Internet café PCs. The attacks have been ongoing since late 2024, prompting responses from management software manufacturers.
A new Dero mining campaign is infecting containerized Linux environments through exposed Docker APIs. The attack uses two Golang malware components: 'nginx' for propagation and 'cloud' for mining. The 'nginx' malware scans for vulnerable Docker hosts, creates malicious containers, and compromises existing ones. It maintains persistence and spreads without a command-and-control server. The 'cloud' component is a modified DeroHE CLI miner with hardcoded wallet and node addresses. This campaign demonstrates the potential risks of insecurely published Docker APIs and the need for robust container security measures.
A new Dero mining campaign exploits insecurely published Docker APIs to spread through containerized Linux environments. The attack uses two Golang malware implants: 'nginx' for propagation and 'cloud' for cryptocurrency mining. The 'nginx' malware scans for vulnerable Docker APIs, creates malicious containers, and compromises existing ones. It maintains persistence and spreads without a command-and-control server. The 'cloud' miner is based on the open-source DeroHE CLI project, with hardcoded wallet and node addresses. This campaign differs from previous attacks on Kubernetes clusters by actively spreading and compromising more networks. The threat highlights the importance of securing containerized infrastructures and monitoring for malicious activities.
