Aokigahara Stealer Grabs Your Claude, Cursor and Copilot Sessions
Check Point says the new Aokigahara infostealer has a dedicated module for AI assistant and coding-tool sessions, plus cloud configs, SSH keys, browsers and crypto wallets.
YARA
Stories with published YARA rules, reproduced exactly as their authors wrote them, ready to copy into your scanner.
Fake ‘GPT-6’ and Claude Apps Hide a Miner Behind Real Signed Installers
Check Point's Yoba campaign pairs genuine signed OpenAI and Anthropic installers with a sideloaded DLL on fake GitHub AI-app pages, installing a hidden XMRig miner via a Telegram-seeded DGA.
A Korean-Speaking Crew Is Building a PHP2Shell Hit List
CYFIRMA says Korean-speaking operators are quietly scanning 216 unpatched PHP hosts at governments, banks and logistics firms, with a moderate-confidence Lazarus link.
Plex Servers Are Quietly Mining Crypto for Someone Else
Attackers are chaining four Plex Media Server bugs, now on CISA's exploited list, to drop a cryptominer and a traffic-relay proxy on servers that never got September's fix.
CriticalCVE-2026-102764 8 Hunt LeadsYARAIOCsARMORY CASTLESAWFLYBARECLAWGoogle Threat Intelligence Group / Mandiant
China-Linked Spies Turned BeyondTrust Help Desks Into Skeleton Keys
Google and Mandiant say suspected Chinese espionage group ARMORY CASTLE has exploited a BeyondTrust Remote Support zero-day since late August. Once inside, it took root, dumped stored credentials and used the support tool to reach internal machines.