Check Point Research
CompanyThreat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Malware reported by Cyber Security NewsYoba malware spread through fake ChatGPT and Claude downloads using signed apps
- Malware reported by GBHackersYoba campaign hides crypto-mining malware in signed OpenAI and Anthropic binaries
- Malware reported by Security AffairsYoba malware hides a crypto miner behind fake ChatGPT and Claude desktop apps
- Vulnerability reported by Zero Day Initiative BlogGitLab CVSS 10.0 flaw targeted on Alpine Linux server; Ivanti, LiteLLM and UAT-6275 also reported
Recent news
Check Point finds jailbreak bundle for Codex that injects adverts into agent files
Check Point Research analysed the Haiou jailbreak bundle for OpenAI Codex, which uses prompt injection and role-play to bypass guardrails and installs security-focused skills. The package also modifies Codex configuration files to inject adverts for an OpenAI-compatible LLM gateway into later responses, which the researchers classify as prompt adware. A threat actor running Cobalt Strike was found using the bundle alongside Ladon and VulnClaw.
Yoba malware spread through fake ChatGPT and Claude downloads using signed apps
Attackers hosted fake GitHub repositories and pages advertising ChatGPT and Claude desktop apps, delivering ZIP archives that sideload the Yoba malware family via a genuine signed installer. The malware then uses a loader that fetches instructions over DNS and deploys an XMRig cryptocurrency miner, with Check Point Research tracking the campaign for about two months. OpenAI and Anthropic were not compromised.
Yoba campaign hides crypto-mining malware in signed OpenAI and Anthropic binaries
Check Point Research reported on 27 October 2026 that a campaign is pairing legitimate, signed OpenAI and Anthropic executables with a malicious winmm.dll to load YobaLoader malware via DLL sideloading. The lures are fake GitHub projects that exploit interest in generative AI, and the payload is cryptocurrency-mining malware. The article is truncated, so further technical detail is not available.
Yoba malware hides a crypto miner behind fake ChatGPT and Claude desktop apps
Check Point Research tracks a campaign called Yoba that uses fake GitHub projects posing as OpenAI and Anthropic desktop apps, delivered via SEO poisoning. Each ZIP pairs a signed Setup.exe with a malicious winmm.dll for DLL sideloading, which installs a multi-stage loader that fetches payloads via Telegram, DNS-over-HTTPS and Catbox, and ends with an XMRig miner routed through Tor.
GitLab CVSS 10.0 flaw targeted on Alpine Linux server; Ivanti, LiteLLM and UAT-6275 also reported
Alpine Linux said on 28 October that an attacker tried to exploit GitLab flaw CVE-2026-97229 (CVSS 10.0) on its GitLab server a week after the fix was released, with no evidence of success. Roundups also cover actively exploited Ivanti Connect Secure and Windows Shell bugs, LiteLLM gateway flaws fixed in version 1.83.9, and Talos and Recorded Future research on UAT-6275, a Kazakhstan-nexus group targeting CIS governments.