Openai threat report

Check Point Research discovered Yoba malware campaign using fake GitHub projects mimicking AI desktop applications to distribute malware via DLL sideloading with legitimate OpenAI and Anthropic signed binaries. The campaign, active since July 2026, employed SEO poisoning to rank malicious repositories in Google search results and distributed cryptocurrency miners through modified installers bundled with Setup.exe from OpenAI and Anthropic.

• Hackers Exploit DLL Sideloading in Signed OpenAI and Anthropic B(opens in a new tab)