Check Point Research

Yoba Campaign Uses Signed ChatGPT and Claude Binaries for DLL Sideloading and XMRig Deployment

Researchers at Check Point Research have uncovered the Yoba malware campaign that distributes fake desktop clients for ChatGPT and Claude through GitHub repositories. The attackers bundle legitimate signed executables from OpenAI and Anthropic with a malicious DLL that gets loaded via classic sideloading. Once executed, the loader establishes persistence using the Windows Task Scheduler and retrieves additional payloads through Telegram, DNS over HTTPS, and the Catbox file hosting service. The campaign ultimately deploys the XMRig cryptominer, which pauses mining activity when user interaction is detected to avoid detection. No compromise of OpenAI or Anthropic infrastructure was found; the attackers simply repurpose the companies' signed binaries and reputation. The operation primarily targets home users and small-to-medium businesses with Windows systems.

Check Point Discloses Two High-Impact Vulnerabilities in LiteLLM AI Gateway Allowing Low-Privilege Users to Steal API Keys

Check Point Research has disclosed two vulnerabilities, CVE-2026-35029 and CVE-2026-59823, in the LiteLLM AI gateway that affect all versions prior to 1.83.9. The flaws enable low-privilege authenticated users to modify gateway configurations, read server files, redirect traffic, and perform SSRF attacks to access internal resources. LiteLLM serves as a unified proxy for over 140 AI providers including OpenAI, Anthropic, and Azure OpenAI, managing API keys, routing, and usage monitoring for enterprises worldwide. The configuration update endpoint lacks role-based access controls, allowing any authenticated user to alter settings and potentially achieve remote code execution. Combined with the SSRF vulnerability, attackers can pivot from low-privilege accounts to compromise internal networks and exfiltrate stored credentials. The project has exceeded 61,000 GitHub stars and recorded over 90 million monthly downloads, making the issues particularly widespread due to its embedding in numerous internal AI platforms. Organizations are advised to upgrade immediately, audit access to management endpoints, rotate all API keys, and scan for hidden LiteLLM instances in requirements files and dependencies.

Check Point Research Uncovers Cross-Session Command Channel in ChatGPT via JFrog Artifactory

Researchers at Check Point Research identified a covert channel that allowed commands to be passed between isolated ChatGPT sessions belonging to different user accounts. The channel exploited an internal JFrog Artifactory instance used by ChatGPT containers for package installation, enabling containers to read and write repository metadata that effectively served as a shared buffer. Attackers could inject malicious instructions into a victim's context through copied prompts, shared conversations, or custom GPTs, causing the assistant to execute hidden tasks while returning normal responses. In a demonstration, ChatGPT silently retrieved data from a connected Gmail account and forwarded it to the attacker's account. The technique potentially exposed chat history, uploaded files, and data from connected services including Google Drive, Microsoft Teams, and GitHub. OpenAI confirmed the affected Artifactory instance has been decommissioned, eliminating the channel, with no evidence of real-world exploitation reported.