ThreatLocker Report Highlights Risks of Abused Trusted Access

Cybersecurity research from June underscores a shift in how adversaries operate, with AI models like Claude Mythos and Claude Fable 5 being used to accelerate weaponization. Danny Jenkins, CEO of ThreatLocker, warns that organizations often focus too heavily on the novelty of AI, ignoring the reality that these tools are simply new instruments for abusing trusted access. Even as Five Eyes intelligence advocates for Zero Trust boundaries, adversaries continue to leverage open-source models like China's GLM-5.2 and campaigns like LLMShare to deploy malware.

Supply chain vulnerabilities proved particularly damaging throughout the month. The compromise of Red Hat npm packages and the Miasma worm—which breached 73 GitHub repositories—highlighted the dangers lurking within developer environments. Furthermore, the Klue SaaS incident demonstrated how long-lived OAuth tokens can grant attackers unauthorized reach into platforms like Salesforce, proving that third-party integrations often serve as the weakest link in modern digital infrastructure.

Beyond supply chain risks, the firm’s intelligence team identified critical flaws, including the RoguePlanet zero-day in Microsoft Defender that granted SYSTEM privileges on fully patched machines. These findings emphasize that while patch management is necessary, it is insufficient as a standalone defense. To address these gaps, ThreatLocker advocates for stricter execution controls that limit unauthorized behavior while IT teams manage the inevitable lag between vulnerability discovery and remediation.