Fake ChatGPT apps mined XMR, self-taught hacker arrested in South Korea, and other cybersecurity news - ForkLog

A fake Padre Terminal app in the App Store drained approximately $23,000 from 27 Solana addresses since October 25, according to blockchain researcher Iris. The attacker converted 4,070 USDC to SOL and transferred 192 SOL to a new wallet, with two addresses now holding 229.66 SOL total. Funds were drained after users imported private keys into the malicious app.

Padre Terminal is actually a browser-based service for trading meme coins on Solana, making any mobile versions fake. The App Store listing has been removed, but thefts continued as recently as October 29. Iris also found four suspicious clones of other crypto services in the App Store: Axiom Pro: Focus, GMGN AI, HyperTerminal-HyperliquidTools, and Pump Fun Tokens & Analytics.

AI Assistants Used for Mining

On October 27, Check Point researchers revealed the Yoba campaign, where hackers disguised a Monero miner as desktop versions of ChatGPT and Claude. The fake projects were hosted on GitHub since July, with tainted releases in late August and early September. Despite no marketing, the links appeared near the top of Google results, likely due to SEO poisoning.

Each archive contained a legitimate installer signed with a digital certificate from OpenAI or Anthropic, plus a trojanized winmm.dll. The malware skipped machines with keyboard layouts for 11 languages including Russian, Belarusian, and Kazakh. At the final stage, the XMRig miner was installed, which mined cryptocurrency via Tor and went idle when someone was using the computer.

Hacker Arrested in South Korea

A self-taught hacker was arrested in South Korea after targeting more than 90 organizations and stealing about 8.2 million records containing personal data and internal documents. The suspect led a group of seven people and had no formal training, learning hacking from blogs and YouTube. From 2019 to 2022, he worked as a pentester testing clients' systems for weaknesses.

Starting in September 2025, his targets included private schools, hospitals, universities, golf clubs, funeral agencies, and subsidiaries of major conglomerates. In roughly 60 cases, he was assisted by artificial intelligence and an autonomous framework called ARTEX that found and exploited vulnerabilities on its own. Victims received emails threatening to publish stolen data, with demands totaling 360 million won (~$270,000) sent to 38 companies.

AI-Discovered Exploits

Specialists from Frontier Red Team used a non-public Claude model to assemble working exploits for Chrome, Safari, and Linux. The AI found dozens of vulnerabilities and combined them into five working attack chains. In one example, a four-bug chain in Chrome on macOS allowed code to escape the sandbox and launch Calculator within seconds of loading a page.

In Safari, the AI disabled the same-origin policy, potentially allowing access to browsing history and cookies. On Android, Claude could copy photos over USB from a stolen Pixel 9 without unlocking it, while on Windows it could remotely crash a machine with HTTP/3 enabled. The most serious issue was a flaw in the Linux kernel's networking stack (CVE-2026-98432) that was fixed on October 15.

Telegram Vulnerability and Botnet Takedown

On October 29, NebuSec researchers disclosed a vulnerability in Telegram for Android that allowed remote code execution simply by answering a voice call. The flaw affected builds from 8.6.2 through 12.10.3, covering four and a half years of releases. The issue was found using NebuSec's Code Security product based on GPT-5.4.

Meanwhile, the Australian Signals Directorate (ASD) revealed previously classified details of offensive operations against cybercriminals, including gaining access to Amadey's command server and disconnecting 180,000 infected machines worldwide. Amadey steals logins and personal information, which are then resold on the dark web. The trojan was hidden in free software, including a pirated version of Photoshop.