Daily Briefing for 04.02.26

Top stories.

• WhatsApp warns Italian users of spyware campaign.
• New malware platform automates ClickFix attacks.
• North Dakota water treatment plant confirms ransomware attack.

WhatsApp warns Italian users of spyware campaign.

WhatsApp has notified around 200 users who downloaded an unofficial iOS version of the app that contained spyware, TechCrunch reports. Most of the affected users were in Italy. WhatsApp stated, "We have logged [the users] out, alerted [them] to the risks to their privacy and security that come with downloading fake unofficial clients, and encouraged them to remove it and download the official WhatsApp app." WhatsApp alleges that Italian surveillance firm SIO created the malicious app, and the Meta subsidiary says it plans to "send a formal legal demand to stop any such malicious activity to this spyware firm."

SIO's subsidiary ASGINT develops spyware for government clients. US-Israeli spyware firm Paragon cut ties with the Italian government last year following reports that the country's intelligence agencies had used Paragon's products to target members of civil society.

New malware platform automates ClickFix attacks.

BlackFog has published a report on a new malware-as-a-service platform called "Venom Stealer" that automates ClickFix social engineering attacks. The platform "builds ClickFix social engineering directly into the operator panel, automates every step after initial access, and creates a continuous exfiltration pipeline that does not end when the initial payload finishes running."

The kit targets Windows and macOS users via ClickFix pages that trick them into running malicious commands on their computers. As soon as the payload is executed, it "sweeps every Chromium and Firefox-based browser on the machine, extracting saved passwords, session cookies, browsing history, autofill data, and cryptocurrency wallet vaults from every profile."

North Dakota water treatment plant confirms ransomware attack.

A ransomware attack hit a water treatment plant serving the city of Minot, North Dakota, on March 14th, the Record reports. City officials confirmed the attack but said there was no impact to safety or operations. Minot's public information officer stated, "There was no direct ask for money and there was no direct interaction beyond a letter on a screen. All necessary local, state, and federal reports have been made."

Workers operated the plant manually for about 16 hours during the incident, checking water gauges on location. Officials stated, "During this event, we had two goals: To be sure our water remained safe, and to ensure proper pressure was maintained in all water storage facilities. Both goals were accomplished thanks to a timely response from all departments involved."