Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries
2026-10-31T02:51:37Z•1ea128d6a645f2daef6c3d35f125a8e9911b099013c1112f7c167319f527698c
CVE-2026-97229APTCISA KEVChina-linked threat actorCiscoDHSGitLabLinux kernelNorth KoreaVMware ESXVolt TyphoonYoba malwarecloud exposurecritical infrastructurecryptocurrency theftcryptominingdata breachexploitationfake AI applicationsincident responsesideloadingsupply-chain attackzero-day
What happened
Security Affairs feed covering active exploitation of GitLab, Cisco, Linux kernel, and Broadcom VMware ESX vulnerabilities; malware campaigns using fake AI applications and signed installers to deploy cryptominers; major suspected cryptocurrency exchange compromises; exposed cloud storage containing sensitive data; data theft affecting DHS personnel; suspected attacks against military infrastructure; and Volt Typhoon zero-day operations using covert relay infrastructure.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 1ea128d6a645f2daef6c3d35f125a8e9911b099013c1112f7c167319f527698c
- Enrichment time
- 2026-10-31T02:51:37Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.