The Virus Informer

Category: Cybersecurity & Malware

News on malware, ransomware, data breaches and digital threats.

  • Ninja Forms plugin flaw exploited to hack WordPress sites

    Ninja Forms plugin flaw exploited to hack WordPress sites

    Cybercriminals are exploiting security flaws in two WordPress plugins to compromise websites. The vulnerabilities affect Ninja Forms, used by over 500,000 sites, and WPC Product Bundles for WooCommerce, active on more than 30,000 sites. Both flaws are cross-site scripting vulnerabilities that require user authentication to exploit. Researchers at Patchstack discovered the campaign targeting WPC Product Bundles on October 4, followed by similar attacks against Ninja Forms the next day. The same malicious JavaScript code was used in both campaigns, suggesting a single threat actor.

    Once activated, the malicious code installs a fake plugin and creates multiple administrator access points, including hidden accounts and secret login URLs designed to evade detection. Even if the malicious plugin is removed, hidden accounts and backup access mechanisms persist. Site administrators are urged to update to the latest plugin versions immediately. However, updating alone does not remove existing infections, so website owners should thoroughly check their sites for signs of compromise and investigate suspicious administrator accounts and access methods.

    Source: Read the full story at BleepingComputer

    This summary was written with AI assistance from the linked source.

  • LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings

    LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings

    Security researchers have demonstrated a vulnerability in LibreOffice and Apache OpenOffice that allows malicious spreadsheets to execute code automatically when opened, without displaying the warning messages typically shown before running macros. The attack requires Java support to be enabled in the affected applications. Currently, the vulnerability exists only as a proof of concept with no confirmed real-world attacks reported.

    LibreOffice has already released patches addressing the flaw, tracked as CVE-2026-63277, with users advised to update to version 26.2.5 or 26.8.0. Apache OpenOffice has not yet fixed the matching vulnerability, designated CVE-2026-59265, though a fix is expected in the upcoming version 4.1.17. Until then, OpenOffice users can mitigate the risk by disabling Java in program settings or avoiding opening untrusted spreadsheet files. The attack exploits legitimate features that work together to download and execute malicious code without user consent.

    Source: Read the full story at The Hacker News

    This summary was written with AI assistance from the linked source.

  • ASOS confirms data breach after “HACKED” in-app notifications

    ASOS confirms data breach after “HACKED” in-app notifications

    ASOS, a major UK-based online fashion retailer, confirmed a data breach after hackers sent unauthorized push notifications through its mobile app on Tuesday morning. The attackers claimed to have compromised the company’s Snowflake environment and demanded engagement, threatening to leak stolen data. ASOS confirmed that unauthorized access occurred to third-party platforms used for customer communications, resulting in exposure of basic personal information such as names and contact details. The company advised customers to disregard the malicious notification and avoid clicking any external links it contained.

    ASOS stated that payment card information and account passwords were not impacted by the breach. However, the company has not verified the threat actor’s claims about compromising its Snowflake environment or disclosed the number of affected customers. A group calling itself “Xuanye group” claimed responsibility for the attack and posted messages to a Telegram channel, stating that customer information was stolen but would remain secure for a designated period. The threat actors did not provide evidence of the breach or specify what customer data was allegedly taken.

    Source: Read the full story at BleepingComputer

    This summary was written with AI assistance from the linked source.

  • Engineer sentenced for locking over 3,000 devices on employer network

    Engineer sentenced for locking over 3,000 devices on employer network

    A former core infrastructure engineer at a New Jersey industrial company has been sentenced to 32 months in prison for conducting a ransomware-style attack on his employer’s network. Daniel Rhyne, 57, from Kansas City, Missouri, pleaded guilty to an extortion plot after being arrested in August 2024. Between November and December 2023, he remotely accessed the company’s systems using administrator credentials and locked thousands of devices by changing passwords on domain and local administrator accounts.

    Rhyne’s actions blocked access to 254 servers and 3,284 workstations. He also deleted server backups and sent a ransom email demanding 20 bitcoins, approximately $750,000 at the time, threatening to shut down 40 random servers daily unless payment was made. Investigators discovered that Rhyne had searched online for information about changing passwords, deleting accounts, and clearing logs before executing his attack. The case is one of several recent prosecutions involving employees attempting to extort their employers through cyber attacks.

    Source: Read the full story at BleepingComputer

    This summary was written with AI assistance from the linked source.

  • Metamask discloses security incident affecting its infrastructure

    Metamask discloses security incident affecting its infrastructure

    MetaMask, a cryptocurrency wallet provider owned by blockchain software company Consensys, disclosed a security incident affecting some of its infrastructure on Thursday. The company stated there is no immediate threat to MetaMask wallets and is addressing the issue with assistance from external partners and security advisors. MetaMask has not disclosed specific details about which infrastructure components were affected or whether any systems or data were compromised.

    As a precautionary measure, MetaMask is exiting validators from its non-custodial staking operations in coordination with partners. Validators are nodes on the Ethereum network responsible for proposing blocks and verifying transactions. The staking platform Lido Finance announced that MetaMask Staking has begun exiting its Ethereum validators, with the process expected to be completed by October 7th, 2026. The company noted this action may result in foregone rewards and possible penalties.

    Source: Read the full story at BleepingComputer

    This summary was written with AI assistance from the linked source.

  • Japanese media group Nikkei discloses cyberattack targeting journalistic sources

    Japanese media group Nikkei discloses cyberattack targeting journalistic sources

    Japanese media company Nikkei disclosed two separate cyberattacks on employee accounts. In the more recent incident, an attacker compromised a Microsoft 365 account and sent approximately 9,000 phishing emails on September 30 to people both inside and outside the company, including journalistic sources. The malicious emails contained links to dangerous websites and targeted individuals who had previously communicated with Nikkei staff. The company changed the account password, detected no further unauthorized access, and contacted recipients. The breach potentially exposed recipient names, email addresses, and some email contents.

    An earlier incident involved unauthorized access to a Google Workspace account used by another employee beginning in late July, potentially compromising personal information of 1,646 people including employees and business partners. Nikkei discovered the intrusion in August after receiving a Google alert. The company found no evidence of subsequent unauthorized logins or misuse of exposed information. These cyberattacks are part of a broader pattern of security breaches affecting major Japanese companies recently, including Daiwa Securities, Yamato Transport, Dai-ichi Life, Sagawa Express, and Ikegami Tsushinki.

    Source: Read the full story at The Record

    This summary was written with AI assistance from the linked source.

  • Google halts open-source bug bounty program amid AI spam surge

    Google halts open-source bug bounty program amid AI spam surge

    Google has temporarily halted submissions to its Open Source Software Vulnerability Rewards Program due to a surge in automated, low-quality reports. The program, which launched in August 2022 and rewards security researchers for identifying flaws in open-source projects like Golang and Angular, will no longer accept product vulnerability submissions. Google stated that the vast majority of recent automated submissions were invalid. The company is working to address these issues and plans to provide updates in the first quarter of 2027.

    Researchers can still submit security patches through Google’s Patch Rewards Program and report vulnerabilities affecting Google Cloud products through its Cloud VRP. Google has distributed over $81.6 million in total rewards since launching its first vulnerability reward program in 2010. This suspension follows similar actions by other organizations, including curl’s decision to end its bug bounty program in January and Intel’s removal of financial rewards for vulnerability reports in September, both citing an overwhelming influx of AI-generated submissions.

    Source: Read the full story at BleepingComputer

    This summary was written with AI assistance from the linked source.

  • OpenAI is adding invisible watermarks to ChatGPT and Codex text in the EU

    OpenAI is adding invisible watermarks to ChatGPT and Codex text in the EU

    OpenAI is implementing invisible watermarks in text generated by ChatGPT and Codex for European Union users. The technology, called textGrain, subtly modifies word choices to create a detectable statistical pattern that remains hidden when text is read or copied. Starting today, API developers worldwide can voluntarily enable watermarking for compatible models, though it is currently disabled by default. OpenAI is accepting applications for access to its watermark detector, with initial access limited to approved researchers and expert organizations.

    However, OpenAI acknowledges significant limitations with its watermarking approach. Testing reveals that ordinary text editing substantially reduces detection effectiveness—replacing just 10 percent of words with synonyms lowered detection rates from 92 percent to 66 percent. Detection performance also varies by subject matter, performing worse in mathematics where models have fewer word choice alternatives. OpenAI cautions that the absence of a detected watermark does not confirm human authorship, and that text may be too brief, edited, or translated for reliable detection. The company states that detected watermarks reveal neither the creator’s identity nor account information.

    Source: Read the full story at BleepingComputer

    This summary was written with AI assistance from the linked source.

  • Warlock ransomware breach SharePoint in water, telecom operator attacks

    Warlock ransomware breach SharePoint in water, telecom operator attacks

    A China-linked ransomware group called Warlock has been attacking critical infrastructure organizations including water utilities, telecommunications providers, government bodies, and universities. The group exploits SharePoint vulnerabilities to gain initial access to systems. Over the past two months, Warlock has primarily targeted organizations in Portuguese and Spanish-speaking regions across Europe, Africa, and Latin America. The group emerged in June 2025 and became notable after exploiting zero-day vulnerabilities in Microsoft SharePoint known as ToolShell.

    During attacks, Warlock deploys tools that disable antivirus and endpoint detection software on multiple hosts simultaneously before launching ransomware. In one documented intrusion beginning July 22, the attacker disabled protection on at least 40 computers within two hours and deployed ransomware on 33 hosts. The attack involved installing Visual Studio Code as a service for remote access and using penetration testing tools for network reconnaissance. Security researchers note that SharePoint vulnerabilities continue to serve as effective entry points for attackers more than a year after Warlock first emerged exploiting these flaws.

    Source: Read the full story at BleepingComputer

    This summary was written with AI assistance from the linked source.

  • Citrix patches NetScaler SAML zero-day exploited in attacks

    Citrix patches NetScaler SAML zero-day exploited in attacks

    Citrix has released emergency security updates to address a new vulnerability in NetScaler appliances that is being actively exploited in targeted attacks. The flaw, identified as CVE-2026-88779, affects NetScaler ADC and NetScaler Gateway devices configured with SAML authentication and has a severity rating of 8.7. The vulnerability is a memory buffer issue that causes denial-of-service conditions when triggered, potentially rendering services unavailable if attacks are repeated. Citrix has released patched versions for affected systems and provided Global Deny Lists to block known malicious IP addresses, but strongly recommends customers install the security updates immediately.

    Security researchers are investigating whether the vulnerability can be used for remote code execution beyond the denial-of-service impact Citrix initially described. After administrators reported unexpected device reboots following patches, investigators discovered crafted authentication requests containing shell commands that appeared designed to download and execute malicious payloads. While the logs showed evidence of attempted exploitation and correlated system crashes, successful execution has not been confirmed. The U.S. Cybersecurity and Infrastructure Security Agency has confirmed the flaw is being actively exploited and set an October 7 deadline for federal agencies to mitigate the vulnerability.

    Source: Read the full story at BleepingComputer

    This summary was written with AI assistance from the linked source.

Powered by CookieAdmin