The tech giant warned of a security flaw that a cybercrime gang said it's exploiting as part of a mass-hacking campaign.