The threat involves an incomplete patch for CVE-2026-21510, a Windows vulnerability affecting SmartScreen and Windows Shell security prompts, which was initially exploited by APT28 for remote code execution via malicious shortcut files. The incomplete patch led to a new authentication coercion vulnerability, CVE-2026-32202, allowing zero-click credential theft through auto-parsed LNK files. These vulnerabilities were exploited in a campaign against Ukraine and EU countries, leveraging Windows shell namespace parsing to load DLLs from remote servers without proper validation. The April 2026 Microsoft patches addressed CVE-2026-32202, closing the zero-click attack vector. The attack chain involved bypassing SmartScreen verification and triggering automatic NTLM authentication handshakes, exposing Net-NTLMv2 hashes for potential relay or offline cracking attacks.

Exploitation of these vulnerabilities enables remote code execution and credential theft without user interaction, allowing attackers to execute arbitrary code and steal authentication hashes. This facilitates further attacks such as NTLM relay and offline password cracking. The threat actor APT28 used these vulnerabilities in targeted attacks against Ukraine and EU countries. The incomplete patch initially left systems vulnerable to zero-click attacks, increasing the risk of stealthy compromise and credential exposure.

Microsoft released official patches for CVE-2026-32202 in April 2026, addressing the incomplete patch issue and mitigating the zero-click attack vector. Systems should be updated with the April 2026 security patches to fully remediate these vulnerabilities. No additional mitigation actions are indicated beyond applying the official fixes.