XMRig
Latest
Phexia macOS stealer spreads through fake fixes that trick users into running Terminal commands
Phexia is a modular macOS backdoor and infostealer sold to several criminal groups, with infections rising since early 2026. Victims are lured by ClickFix-style fake verification pages into running a curl command that pipes a script into bash, which installs a LaunchAgent disguised with an Apple-like label. The malware gets the user's password via a fake System Preferences prompt, then steals browser data, keychain files and LastPass and NordPass extension data, and installs the XMRig miner.
Yoba malware spread through fake ChatGPT and Claude downloads using signed apps
Attackers hosted fake GitHub repositories and pages advertising ChatGPT and Claude desktop apps, delivering ZIP archives that sideload the Yoba malware family via a genuine signed installer. The malware then uses a loader that fetches instructions over DNS and deploys an XMRig cryptocurrency miner, with Check Point Research tracking the campaign for about two months. OpenAI and Anthropic were not compromised.
Yoba malware hides a crypto miner behind fake ChatGPT and Claude desktop apps
Check Point Research tracks a campaign called Yoba that uses fake GitHub projects posing as OpenAI and Anthropic desktop apps, delivered via SEO poisoning. Each ZIP pairs a signed Setup.exe with a malicious winmm.dll for DLL sideloading, which installs a multi-stage loader that fetches payloads via Telegram, DNS-over-HTTPS and Catbox, and ends with an XMRig miner routed through Tor.