Threat Briefing: November 6, 2026

This week’s stories share a common thread: attackers exploiting trust in familiar platforms, brands, and authentication mechanisms.

• Bank phishing: A campaign targeting customers of roughly 300 mostly midsize U.S. banks uses commodity infrastructure, possibly phishing-as-a-service, and repeat-visit cloaking to outlast takedowns.
• VOLTA-AUTODOXER: This infostealer uses AI to prioritize stolen credentials, OAuth tokens, and cloud keys.
• Yoba: Fake ChatGPT and Claude desktop apps spread via GitHub using code signing and DLL sideloading, with a loader that can accept additional payloads.
• GitLab: A maximum-severity RCE flaw is exploited in the wild, with over 1,000 unpatched instances exposed.

Overall, this reflects the steady industrialization of attack tooling, not a sudden shift. Strong patching, source verification, and token hygiene remain the best defenses.

• OpenSSH Flaw Bypasses Password-Disabled Accounts on musl Linux – A vulnerability dubbed *sshole, present since a 2016 OpenSSH patch, lets attackers log into password-disabled accounts on musl-based Linux by submitting a password over 256 bytes. It is fixed in OpenSSH 10.6p2; Alpine admins can update with apk upgrade openssh. BleepingComputer
• Phishing Campaign Spoofs 300 U.S. Banks – Active since May, the campaign targets customers of roughly 300 mostly midsize and regional U.S. banks, plus crypto exchanges and Treasury services users, and uses repeat-visit cloaking to evade takedowns. As of October 25, Kela found 248 live domains impersonating 189 financial firms. Bank Info Security
• VOLTA-AUTODOXER Infostealer Uses AI to Rank Stolen Data – Cisco Talos found a Windows infostealer that sends stolen data to an AI model via the OpenRouter API, ranking assets by how easily they can be monetized. It targets browser credentials, cloud and SSH keys, OAuth tokens, crypto wallets, and session data. Help Net Security
• 1,000+ GitLab Servers Unpatched Against Exploited Max-Severity RCE – CISA added CVE-2026-97229 to its KEV catalog after confirming active exploitation. Despite patches being available for three weeks, Shadowserver reports over 1,000 exposed servers remain unpatched. BleepingComputer
• Fake ChatGPT and Claude Apps on GitHub Deliver Yoba Cryptominer – Check Point Research found fake desktop apps that bundle malware with genuine signed OpenAI and Anthropic executables and load it via DLL sideloading. Yoba installs a cryptominer on Windows and supports additional payloads. Hackread