Cybersecurity Archives - The Threat Box

Miasma Supply Chain Worm Hits npm, PyPI, and Microsoft Azure

06/30/2026 by The Threat Box Team

Miasma Supply Chain Worm Infects npm, PyPI, and Microsoft Azure Repositories A fast-moving supply chain campaign dubbed Miasma is spreading across open-source software registries this week, weaponizing a novel install-time technique to steal developer credentials, poison build pipelines, and self-propagate across enterprise cloud environments. Security researchers have confirmed three distinct waves since June 1, 2026, … Read more

Klue Supply Chain Attack Exposes CRM Data Across Major Firms

06/23/2026 by The Threat Box Team

A sweeping supply chain attack against Klue, the Vancouver-based competitive intelligence platform, has triggered cascading data breaches at more than a dozen major technology and cybersecurity firms, including Huntress, Recorded Future, Jamf, and Tanium. The Icarus extortion group compromised a legacy integration credential at Klue on June 11, 2026, planted malicious code to harvest customer … Read more

GentleKiller Ransomware Disables 400+ EDR Security Processes

06/21/2026 by The Threat Box Team

A newly uncovered EDR-killing framework known as GentleKiller has emerged as one of the most aggressive tools in the ransomware landscape this year, systematically terminating over 400 endpoint protection processes across 48 distinct security products. The framework, developed and maintained by the Gentlemen ransomware-as-a-service operation, exploits the Bring Your Own Vulnerable Driver (BYOVD) technique to … Read more

Anthropic AI Export Ban Pulls Fable 5, Mythos 5 Offline

06/14/2026 by The Threat Box Team

Anthropic AI Export Ban: US Forces Fable 5 and Mythos 5 Offline Worldwide Anthropic has pulled its two most capable AI models offline for all users worldwide after the US government issued an unprecedented export control directive ordering the company to cut off access to them for all foreign nationals. The Anthropic AI export ban … Read more

Claude Code GitHub Action Flaw Enabled Repository Hijacking

06/04/2026 by The Threat Box Team

Claude Code GitHub Action Flaw Enabled Full Repository Takeover via a Single Bot Issue A critical vulnerability in Anthropic’s Claude Code GitHub Action gave attackers the ability to fully compromise any public repository running the tool, using nothing more than a single GitHub issue submitted by a bot account. Discovered by security researcher RyotaK of … Read more

AI-Built Ransomware Toolkit Automates EDR Evasion in 2026

06/03/2026 by The Threat Box Team

AI-Built Ransomware Toolkit Automates EDR Evasion, Leverages Claude Agents for Attack Development Researchers at Sophos have uncovered an active threat actor operating a fully functional, AI-built ransomware toolkit that automates Active Directory (AD) reconnaissance, systematically tests endpoint detection bypass techniques, and uses multiple AI agents, including one powered by Claude Opus 4.5, to build and … Read more

CVE-2026-41089: Critical Windows Netlogon RCE Exploited

06/01/2026 by The Threat Box Team

CVE-2026-41089: Critical Windows Netlogon RCE Flaw Now Actively Exploited A critical Windows Netlogon remote code execution flaw is now being actively weaponized in the wild, three weeks after Microsoft shipped the patch. CVE-2026-41089, carrying a near-perfect CVSS score of 9.8, allows unauthenticated attackers to seize full SYSTEM-level control of any unpatched Windows domain controller by … Read more

Microsoft 365 Outage Blocks Teams and Office Web File Access

06/01/2026 by The Threat Box Team

Microsoft 365 Outage Blocks Teams and Office Web Access A Microsoft 365 outage struck organizations worldwide on June 1, 2026, blocking users from opening files in Microsoft Teams and Office for the web. Microsoft confirmed the incident through its official Microsoft 365 Status channel on X, directing administrators to incident notice MO1329446 in the Microsoft … Read more

Microsoft enforces registered-only authentication for Entra ID

05/31/2026 by The Threat Box Team

Microsoft Entra ID SSPR Will Only Accept Registered Authentication Methods Starting September 2026 Microsoft has formally notified customers that a significant shift is coming to how Microsoft Entra ID handles identity verification during Self-Service Password Reset (SSPR). Under Message Center update MC1325414, the company is moving to a model where only explicitly registered authentication methods … Read more