The Virus Informer

Author: The Virus Informer

  • Warlock ransomware breach SharePoint in water, telecom operator attacks

    Warlock ransomware breach SharePoint in water, telecom operator attacks

    A China-linked ransomware group called Warlock has been attacking critical infrastructure organizations including water utilities, telecommunications providers, government bodies, and universities. The group exploits SharePoint vulnerabilities to gain initial access to systems. Over the past two months, Warlock has primarily targeted organizations in Portuguese and Spanish-speaking regions across Europe, Africa, and Latin America. The group emerged in June 2025 and became notable after exploiting zero-day vulnerabilities in Microsoft SharePoint known as ToolShell.

    During attacks, Warlock deploys tools that disable antivirus and endpoint detection software on multiple hosts simultaneously before launching ransomware. In one documented intrusion beginning July 22, the attacker disabled protection on at least 40 computers within two hours and deployed ransomware on 33 hosts. The attack involved installing Visual Studio Code as a service for remote access and using penetration testing tools for network reconnaissance. Security researchers note that SharePoint vulnerabilities continue to serve as effective entry points for attackers more than a year after Warlock first emerged exploiting these flaws.

    Source: Read the full story at BleepingComputer

    This summary was written with AI assistance from the linked source.

  • Citrix patches NetScaler SAML zero-day exploited in attacks

    Citrix patches NetScaler SAML zero-day exploited in attacks

    Citrix has released emergency security updates to address a new vulnerability in NetScaler appliances that is being actively exploited in targeted attacks. The flaw, identified as CVE-2026-88779, affects NetScaler ADC and NetScaler Gateway devices configured with SAML authentication and has a severity rating of 8.7. The vulnerability is a memory buffer issue that causes denial-of-service conditions when triggered, potentially rendering services unavailable if attacks are repeated. Citrix has released patched versions for affected systems and provided Global Deny Lists to block known malicious IP addresses, but strongly recommends customers install the security updates immediately.

    Security researchers are investigating whether the vulnerability can be used for remote code execution beyond the denial-of-service impact Citrix initially described. After administrators reported unexpected device reboots following patches, investigators discovered crafted authentication requests containing shell commands that appeared designed to download and execute malicious payloads. While the logs showed evidence of attempted exploitation and correlated system crashes, successful execution has not been confirmed. The U.S. Cybersecurity and Infrastructure Security Agency has confirmed the flaw is being actively exploited and set an October 7 deadline for federal agencies to mitigate the vulnerability.

    Source: Read the full story at BleepingComputer

    This summary was written with AI assistance from the linked source.

  • 2 enhanced flu vaccines offer similar protection against infection in older adults

    2 enhanced flu vaccines offer similar protection against infection in older adults

    A new study published in the International Journal of Infectious Diseases found that adjuvanted and high-dose flu vaccines provide similar protection against confirmed influenza infection and hospitalization in older adults. Both vaccine types are designed to strengthen immune responses in people aged 65 and older, who face greater risks from severe flu complications. Adjuvanted vaccines contain an ingredient that enhances immune response, while high-dose vaccines contain increased amounts of viral antigen.

    Researchers analyzed data from over 37,000 American adults aged 65 and older who received one of these two vaccines during the 2023–24 flu season. Among those who sought care for acute respiratory illness and were tested, approximately 8.5% tested positive for influenza. The study found no statistically significant difference in effectiveness between the two vaccine types, with results consistent with previous research from the 2022–23 season and a meta-analysis of 10 additional studies.

    Source: Read the full story at CIDRAP

    This summary was written with AI assistance from the linked source.

  • Judge dismisses spyware case brought by Salvadoran journalists targeted with Pegasus

    Judge dismisses spyware case brought by Salvadoran journalists targeted with Pegasus

    A federal judge in California dismissed a lawsuit filed by journalists from the Salvadoran news outlet El Faro who had their devices infected with Pegasus spyware. The judge determined the court lacked jurisdiction to hear the case, finding it was entirely foreign in nature. Lead plaintiff Carlos Dada and his colleagues experienced at least 226 spyware attacks between June 2020 and November 2021. The Knight First Amendment Institute filed the lawsuit on their behalf in November 2022, making it the first case brought against Pegasus manufacturer NSO Group in a U.S. court.

    The plaintiffs argued the case could be heard in California because the attacks used compromised infrastructure located in the state. They sought court orders requiring NSO to delete collected data and identify the client who ordered the surveillance. Phone access became more frequent before major investigations were published. While a previous judge dismissed the case in March 2024, the current decision allows for potential appeal. The Knight Institute announced plans to challenge the dismissal.

    Source: Read the full story at The Record

    This summary was written with AI assistance from the linked source.

  • Quick takes: NWS-related border reopening, dengue in Florida, NIH PubMed tool, sprout recall, more polio

    Quick takes: NWS-related border reopening, dengue in Florida, NIH PubMed tool, sprout recall, more polio

    A livestock crossing between New Mexico and Mexico reopened after being closed for 18 months due to concerns about New World screwworm importation from Mexican cattle. The US Agriculture Secretary stated that while the pest has not been eliminated from the United States, the crossing will remain open only if Mexican authorities continue following a joint surveillance and treatment plan. This year, the disease has been detected in 49 animals across Texas and New Mexico, including cases in horses.

    Three counties in west-central Florida declared states of emergency to address rising dengue fever cases, with 177 confirmed cases reported in Hillsborough County as of late September, including one death. The emergency declarations will enable officials to take actions to control mosquito populations and seek federal reimbursement for expenses. Meanwhile, the National Institutes of Health launched an artificial intelligence tool called Linked Discoveries to help researchers better understand how individual research findings connect to broader biomedical evidence, currently linking over 29 million publications.

    Source: Read the full story at CIDRAP

    This summary was written with AI assistance from the linked source.

  • Bipartisan backlash to ALPRs grows as two high-profile bills are introduced

    Bipartisan backlash to ALPRs grows as two high-profile bills are introduced

    Congressional leaders from both political parties have introduced legislation targeting artificial intelligence-powered automatic license plate recognition cameras following growing bipartisan concerns about privacy and surveillance. Senator Josh Hawley introduced the Stop Flock Abuse Act on Wednesday to strengthen protections for these cameras and safeguard constitutional rights. Three days later, Senators Bernie Sanders and Jeff Merkley, along with Representative Alexandria Ocasio-Cortez, unveiled a broader proposal that would prohibit federal use of the technology and block federal funding to states that deploy it. The legislation would also allow Americans to pursue legal action if their rights are violated by such cameras.

    Grassroots organizers in various states have highlighted concerns about mass surveillance and documented cases of misuse, including police arrests based on incorrect license plate matches. A cybersecurity researcher published findings showing approximately 300,000 Flock-connected devices nationwide, though the company claims it operates only 120,000 cameras. Recent incidents have included unauthorized camera installations and improper police searches using the technology. Flock Safety responded by expressing support for legislation establishing guidelines while maintaining that the cameras enhance public safety. Privacy advocates noted that while bipartisan support represents progress, a complete ban would be necessary for full protection.

    Source: Read the full story at The Record

    This summary was written with AI assistance from the linked source.

  • Anthropic asks Claude users to share voice data for AI model training

    Anthropic asks Claude users to share voice data for AI model training

    Anthropic is requesting that Claude users voluntarily share voice conversation data to help train and enhance its artificial intelligence models. When using Claude’s voice features, users see a prompt asking permission to use their voice data for AI training purposes. The company explains that audio recordings and voice chat data help improve how its AI models understand and respond to speech. Users can accept or decline the request, and they have the ability to manage this setting at any time through Claude’s privacy settings.

    The voice data training option operates independently from Anthropic’s existing feature that allows users to opt into training using their regular text chats and coding sessions. This separation means users can choose to share voice data while keeping other conversations private, or vice versa. By default, the voice data sharing setting is disabled, so Anthropic is not automatically enrolling users into this program. Users also have the option to delete their voice data from settings if they change their minds about participation.

    Source: Read the full story at BleepingComputer

    This summary was written with AI assistance from the linked source.

  • Google Gemini could soon get full access to your Mac’s files, apps and the web

    Google Gemini could soon get full access to your Mac’s files, apps and the web

    Google is developing a new feature for Gemini that would grant the AI assistant broad access to macOS devices. The feature, currently in testing and not yet publicly available, would allow Gemini to read, create, modify, and delete files anywhere on a Mac, access applications like Mail and Safari, and browse the web. When enabled through hidden “Additional sandbox options” settings, Gemini could perform certain actions without requiring permission for each task.

    Google has incorporated some privacy safeguards into the system. Gemini would still request user confirmation before completing sensitive actions such as making purchases, transferring money, creating online accounts, or modifying personal information. The company has not yet announced when this full access feature will be rolled out or specified which Gemini model will support it. The development comes as Apple considers implementing restrictions on how AI agents access personal files and data on Mac devices.

    Source: Read the full story at BleepingComputer

    This summary was written with AI assistance from the linked source.

  • Measles milestones: US closes in on 4,000 cases as Pennsylvania nears 1,000

    Measles milestones: US closes in on 4,000 cases as Pennsylvania nears 1,000

    The United States has nearly reached 4,000 measles cases in 2026, with the CDC reporting 3,886 infections as of this week. This represents a dramatic increase compared to previous years, with cases already exceeding the 2025 total of 2,289. The country has experienced eight consecutive weeks of triple-digit case increases, with 42 active outbreaks currently tracked across 45 states, plus New York City and Washington, DC. About 95% of patients are unvaccinated or have unknown vaccination status, and 61% involve children and teens.

    Pennsylvania remains the outbreak epicenter with 977 cases, nearing 1,000. The state has reported a fifth measles-related death this week, though the CDC’s national count remains at two deaths. Pennsylvania’s cases concentrate in Lancaster County with 391 infections, followed by Mifflin County with 117. Unlike national trends where 61% of cases involve children and teens, Pennsylvania has seen 69% of infections in adults. The Pennsylvania Department of Health emphasizes that the MMR vaccine provides 97% lifetime protection and remains the best defense against measles.

    Source: Read the full story at CIDRAP

    This summary was written with AI assistance from the linked source.

  • Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign

    Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign

    A China-linked threat actor has launched a campaign targeting government and policy organizations across Asia using a previously unknown backdoor called Antino. The intrusion set, tracked as UAT-11587, has affected 16 entities in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria since September 2025. The malware, written in Rust, enables host reconnaissance, command execution, file transfers, and persistence on infected systems.

    UAT-11587 uses a sophisticated spear-phishing approach that includes spoofed sender identities and fake Gmail attachment previews to trick recipients into downloading malicious files. The attack chain eventually deploys Antino, which communicates through Microsoft 365 services rather than traditional command-and-control servers, using Outlook for commands and OneDrive for data transfer. Attacks peaked between March and June 2026, with a concentrated wave occurring on June 8 and 9, 2026, targeting government IT infrastructure across multiple nations.

    Source: Read the full story at The Hacker News

    This summary was written with AI assistance from the linked source.

Powered by CookieAdmin