VECT 2.0 Ransomware Unmasked as Destructive Wiper, CISA Warns of Actively Exploited Windows Flaw

The GlassWorm campaign has launched a new wave involving 73 malicious 'sleeper' extensions on the Open VSX marketplace. Unlike previous iterations, these extensions initially appear benign, remaining dormant to evade detection. They are now engineered as thin loaders with the capability to fetch and execute secondary malicious payloads at a later date. This tactical shift makes the malware more evasive and resilient, as the primary malicious logic is not present upon initial installation, posing a severe threat to developers and the software supply chain. This evolution makes detection harder and allows attackers to change payloads dynamically.

Rituals Cosmetics has updated the estimated number of affected customers to up to 41 million, an increase from the previously reported 'over 40 million'. The newly disclosed compromised data now includes customers' preferred store locations, in addition to names, addresses, phone numbers, email, DOB, and gender. This expanded scope further heightens the risk of identity theft and targeted phishing campaigns for a larger number of individuals across the UK, Europe, and the U.S.

The sophisticated Signal phishing campaign, initially reported to target German politicians, has now been observed impacting military personnel and journalists, with similar attacks reported in the UK and Netherlands. The attack method involves tricking users into scanning a malicious QR code or entering a PIN, abusing Signal's 'Link New Device' feature to gain account access. In response to these widespread account takeover attempts, Signal has announced plans to implement additional security measures to better protect users.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added CVE-2026-32202 to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch the flaw. This update clarifies the vulnerability as an authentication coercion and privilege escalation issue, not just spoofing. Crucially, new information details a 'zero-click' attack vector where malicious LNK files can trigger NTLM hash theft without user interaction, for example, via File Explorer's preview pane. This significantly increases the attack's stealth and potential impact, leading to credential theft, privilege escalation, and lateral movement. New hunting hints include outbound SMB traffic and specific log events, with mitigation advice to block outbound SMB and consider disabling NTLM.

Software security firm Checkmarx has confirmed data exfiltration, including source code, API keys, and employee details, following a sophisticated supply chain attack by TeamPCP. The Lapsus$ group has claimed responsibility for leaking the stolen data. This incident originated from credentials compromised in the earlier Trivy supply chain attack, which led to the poisoning of Checkmarx's KICS open-source project. Attackers demonstrated persistence, deploying a second wave of malicious code on April 22, 2026, and also compromising the command-line interface of the Bitwarden password manager. This significantly escalates the impact and scope of the ongoing campaign.