Warlock ransomware expands SharePoint attacks targeting critical infra

🚨 ACTIVE EXPLOITATION

• Warlock ransomware group expands SharePoint exploitation against critical infrastructure
  The China-linked Warlock ransomware group continues exploiting SharePoint vulnerabilities to attack critical infrastructure, government, education, and telecom organizations.
  • Targets include critical infrastructure operators, government bodies, universities, and telecom providers; recent victims include a water utility and telecom provider in Portuguese- and Spanish-speaking countries.
  • Warlock, tracked as Longlegs (Symantec) and Storm-2603 (Microsoft), has exploited SharePoint flaws since July 2025, including ToolShell zero-days CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771, plus newer flaws such as CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522, and CVE-2026-55040.
  • Attacks deploy ASPX webshells, steal ASP.NET machine keys to forge signed __VIEWSTATE payloads for RCE, and load follow-on malware via DLL sideloading.
  • The group uses a vulnerable signed driver (CVE-2025-1055, K7 Security Anti-Malware before 23.0.0.10) to kill AV/EDR on dozens of hosts, abuses Visual Studio Code tunnels for covert access, and stages ransomware in SYSVOL shares for domain-wide encryption.
  • Payloads are retrieved from legitimate hosting services including Catbox and Wasabi; observed IOCs include litter[.]catbox[.]moe and xn8xyt-drop[.]s3[.]wasabisys[.]com.
  Sources 📄 Source: cybersecuritynews.com · 📎 Coverage: securityweek.com · 👁 via SecurityWeek

💥 BREACHES & INCIDENTS

• Microsoft's official X account hijacked to promote fake Clippy crypto token
  Attackers hijacked Microsoft's official X account to promote a fake Clippy-themed crypto token in an apparent pump-and-dump scheme.
  • Microsoft's @Microsoft X account, with over 13 million followers, was compromised on Thursday, October 1, 2026.
  • The account followed and reposted tweets from @clippymsftcto, a now-suspended account impersonating Clippy, and its profile picture was changed to a Clippy-themed image.
  • A related account, @ClippyMSFT, promoted a $Clippy token claiming a liquidity pool paired with $MSFT; Microsoft denies any affiliation and says it will pursue legal action.
  • Microsoft confirmed unauthorized access, secured the account, and removed the posts; how attackers gained access remains unknown.
  Sources 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

🕵️ RESEARCH & DEEP DIVES

• Milk Dragon AiTM phishing kit uses real-time OTP relay and WebSocket keylogging to bypass MFA
  Group-IB has exposed Milk Dragon, a phishing-as-a-service kit that steals card data and relays one-time passwords in real time to bypass MFA.

  • Targets social media shoppers across 66 countries, with 258 phishing pages and 36 banking verification templates identified since October 2025.
  • Kit impersonates 21 brands including LEGO, Calvin Klein, and Aeon Malaysia, stealing card details and 3-D Secure OTP codes.
  • Lures are discount-themed Facebook and TikTok marketplace ads, sometimes backed by fake profiles with AI-generated content and purchased followers.
  • Victims land on WordPress/WooCommerce storefronts where a malicious plugin, BytePress, adds fake card and PayPal payment options and links to an operator panel.
  • A persistent Socket.IO WebSocket streams keystrokes character by character and lets operators relay OTPs in real time; the kit is sold via Telegram from 300 USDT per month.
  Sources 📄 Source: group-ib.com · 📎 Coverage: gbhackers.com · 👁 via Cyber Security News, cryptika.com (discovered)

• Compass Security details unauthenticated RCE chain in Home Assistant Green via Music Assistant add-on
  Compass Security researchers exploited an unauthenticated remote code execution chain in the Music Assistant add-on to root the Home Assistant Green at Pwn2Own Ireland 2025.

  • Applies to Home Assistant Green and Home Assistant installations running the official Music Assistant add-on.
  • Music Assistant exposes an unauthenticated web interface on port 8095, added to fix provider setup callback issues.
  • The music/playlists/update command allows arbitrary file writes by omitting the .m3u extension on playlist paths.
  • Code execution was achieved via site-specific configuration hooks, then pivoted to the Supervisor REST API (homeassistant_api: true) and root access on the underlying OS.
  • Fixed in Music Assistant server 2.7.0 (PR #2661).
  Sources 📄 Source: github.com · 📎 Coverage: blog.compass-security.com · 👁 via Compass Security

📋 ADVISORIES

• UPDATE: SP Page Builder Joomla 3 security patch was incomplete; version 1.0.3 closes captcha bypass and XSS gaps
  JoomShaper released SP Page Builder Joomla 3 Security Patch 1.0.3 after the earlier 1.0.2 patch left a captcha bypass and an incomplete XSS fix unpatched.
  • Applies to Joomla 3 sites running SP Page Builder, which cannot install the 6.x package that fixed the same issues in version 6.9.1
  • Version 1.0.2 back-ported four of five reported flaws but left CVE-2026-79701, an unauthenticated captcha bypass in the Contact Form, Opt-in Form and Form Builder addons (6.6 CVSS 4.0), live on Joomla 3
  • The XSS fix for CVE-2026-102426, a reflected XSS in the dynamic content filter addon (5.1 CVSS 4.0, Joomla 3 only), escaped only one of two sinks on the same line
  • The captcha bypass works when an anonymous visitor claims the form sits inside a module, so reCAPTCHA verification is skipped; the opt-in form was absent from the 1.0.2 patch entirely
  • mySites.guru verified both gaps on a Joomla 3.10.12 test site on 14 September 2026 and reported them to JoomShaper the same day
  Sources 📎 Coverage: mysites.guru · 👁 via mysites.guru (discovered)

🔓 CVEs & KEV

• CVE-2026-94541 — amauric WPMobile.App – Android and iOS App Builder — CVSS 9.8 — WPMobile.App through 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_cat...

• CVE-2026-97637 — parorrey JSON API Auth — CVSS 9.8 — JSON API Auth through 3.1.2 - Unauthenticated Authentication Bypass via Cached 'ge...

• CVE-2026-64949 — Pandora FMS — CVSS 8.6 — Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File...

• CVE-2026-64950 — Pandora FMS — CVSS 8.4 — Stored Cross-Site Scripting via Directory Name in File Manager Create Directo...

• CVE-2026-103493 — Jetbrains Youtrack — CVSS 8.1 — In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX co...

• CVE-2026-64947 — Pandora FMS — CVSS 7.5 — CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in ...

• CVE-2026-64946 — Pandora FMS — CVSS 7.4 — CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Uploa...

• CVE-2026-75786 — Pandora FMS — CVSS 7.2 — SQL Injection in Grafana Integration Endpoint (query.php)Unsanitized concaten...

• CVE-2026-103490 — JetBrains YouTrack — CVSS 7.2 — In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible v...

• CVE-2026-64948 — Pandora FMS — CVSS 7.1 — Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group M...

• CVE-2026-103494 — Jetbrains Youtrack — CVSS 6.6 — In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible v...

• CVE-2026-103492 — Jetbrains Youtrack — CVSS 6.5 — In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted...

• CVE-2026-103491 — Jetbrains Youtrack — CVSS 6.5 — In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API al...