Aokigahara Stealer Grabs Your Claude, Cursor and Copilot Sessions
Check Point says the new Aokigahara infostealer has a dedicated module for AI assistant and coding-tool sessions, plus cloud configs, SSH keys, browsers and crypto wallets.
YARA
Stories with published YARA rules, reproduced exactly as their authors wrote them, ready to copy into your scanner.
5 stories match your filters.
Fake ‘GPT-6’ and Claude Apps Hide a Miner Behind Real Signed Installers
Check Point's Yoba campaign pairs genuine signed OpenAI and Anthropic installers with a sideloaded DLL on fake GitHub AI-app pages, installing a hidden XMRig miner via a Telegram-seeded DGA.
A Korean-Speaking Crew Is Building a PHP2Shell Hit List
CYFIRMA says Korean-speaking operators are quietly scanning 216 unpatched PHP hosts at governments, banks and logistics firms, with a moderate-confidence Lazarus link.
Plex Servers Are Quietly Mining Crypto for Someone Else
Attackers are chaining four Plex Media Server bugs, now on CISA's exploited list, to drop a cryptominer and a traffic-relay proxy on servers that never got September's fix.
CriticalCVE-2026-102764 8 Hunt LeadsYARAIOCsRemote AttackerARMORY CASTLESAWFLYBARECLAWGoogle Threat Intelligence Group / Mandiant
China-Linked Spies Turned BeyondTrust Help Desks Into Skeleton Keys
Google and Mandiant say suspected Chinese espionage group ARMORY CASTLE has exploited a BeyondTrust Remote Support zero-day since late August. Once inside, it took root, dumped stored credentials and used the support tool to reach internal machines.