Yoba's loader hides behind legitimately signed AI installers. Check Point traces fake "AI" GitHub projects and SEO poisoning to ZIPs pairing a signed OpenAI/Anthropic Setup.exe with a malicious winmm.dll for sideloading, then launch/locale/admin checks and long sandbox delays, a masquerading scheduled task for persistence, and payload retrieval via a Telegram plus DNS-over-HTTPS domain-generation scheme. Observed payload is a Tor-based XMRig miner, but the framework can carry anything (Security Affairs); earlier coverage.
· Threat Activity
· also via fake recruiter
October 29, 2026
Yoba lures victims to fake GitHub "AI desktop app" repos and sideloads DLLs via signed ChatGPT and Claude binaries, with anti-analysis checks and a Telegram/DGA plus DoH C2 chain (Ed25519-signed, AES-encrypted) that currently drops XMRig but is a generic loader (Check Point). Separately, a Chinese-speaking actor is SEO-poisoning DeepSeek download searches to deliver Kong RAT through a multi-stage chain (Hybrid Analysis).
· Threat Activity
· also via browser extension
September 20, 2026
Transparent Tribe (APT36) is running "Operation RapidRust" against Indian and Afghan government and defence targets with four previously undocumented tools: RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. Zscaler ThreatLabz notes RUSTYSHADE uses attacker-controlled private GitHub repos for encrypted C2, reading and writing command.txt, results.txt, heartbeat.txt and exfil blobs over the GitHub REST API — traffic that blends into normal developer noise. Delivery leans on typosquatted Indian news domains (theprints[.]org, indiatodays[.]org). The Hacker News
· Threat Activity
September 12, 2026
CL-CRI-1171 has operated a pay-per-install service for at least two years.Unit 42 mapped more than 10,000 distinct OfferLoader samples and at least 11 gaming-focused YouTube channels, plus an SEO-poisoning funnel that reached corporate, government, and critical-infrastructure endpoints. Payloads observed between July 2025 and April 2026 included Insomnia RAT, Docro Hijacker, and ARKTunnel.
· Threat Activity
September 6, 2026
The EtherHiding campaign now spans more than 5,400 compromised websites. Injected scripts or spoofed packages contact BNB Smart Chain testnet contracts for takedown-resistant payload storage before displaying a ClickFix lure. Netskope also found a newer WebRTC-based variant. Netskope and BleepingComputer
· Threat Activity
August 25, 2026
GTA VI leak fallout is now a malware-delivery vehicle, with magnet links to supposed game builds circulating as masqueraded payloads and at least one group falsely invoking researchers' names to lure DMs (vx-underground) (discussion).
· Threat Activity
SynkLoader gets a fuller profile: multilingual, feature-rich, and reviving screen hijacking for credential theft, with behaviour that researchers think points toward ransomware staging — echoing the fake-lock-screen loader flagged last week (Dark Reading) (earlier coverage).
· Malware & Supply Chain
PavinLoader turns up across ClickFix and fake-download campaigns, chaining heavily obfuscated trojanised .NET DLLs executed via MSBuild, .csproj and .bat files, with EtherHiding for stage retrieval — the same developer-tooling abuse pattern as today's T4 research (Malwarebytes, surfaced by NCSC-FI).
· Malware & Supply Chain
July 2, 2026
Kaspersky tracked a "massive, multi-domain" SEO-poisoning campaign abusing ScreenConnect to deploy AsyncRAT via fake installers for OBS Studio, DS4Windows, Bandicam and others. The Hacker News.
· Threat Activity
June 30, 2026
The DFIR Report walked an intrusion from a poisoned Bing search result through Bumblebee loader and AdaptixC2 to Akira ransomware deployment. The DFIR Report
· Threat Activity