WantToCry ransomware remotely encrypts files

Multiple Sophos posts in May 2026 describe active threats and defensive guidance: a WantToCry ransomware campaign is remotely encrypting files after brute‑forcing SMB credentials; a malicious VS Code extension led to cloning of private GitHub repositories (reported for sale) indicating a targeted supply‑chain/IDE compromise; the AMOS (Atomic macOS Stealer) family is scaling macOS data‑theft operations; and Microsoft’s May Patch Tuesday disclosed 132 CVEs (with advisories pushing the month’s total toward ~300). Sophos also highlights successful blocking of a novel supply‑chain attack by Sophos