Threat Intelligence Blog
Research, insights, and updates from the isMalicious team. Page 4 of 10.
GitHub Actions and CI/CD Pipeline Compromise: A Growing Supply Chain Attack Vector
CI/CD pipeline compromises keep recurring across GitHub Actions ecosystems. Learn the detection signals, hardening steps, and enrichment workflow security teams need.
Infostealer Log Marketplaces: How Stolen Corporate Credentials End Up for Sale
Stealer-log marketplaces are booming in 2026, trading stolen corporate cookies, passwords, and SaaS sessions that fuel ransomware access and bypass MFA.
Subdomain Enumeration for Security Teams: Attack Surface Discovery and DNS Reconnaissance
Subdomain enumeration surfaces forgotten dev servers, dangling DNS, and shadow IT before attackers do. Passive and active recon techniques compared.
Malicious Browser Extensions Are Stealing Session Cookies: Detection Guide
Rebranded browser extensions are harvesting session cookies and OAuth tokens after silent updates. Here is how to detect and respond before EDR ever sees it.
urlscan.io vs isMalicious: URL Scanning
urlscan.io captures what a page does; isMalicious tells you if it is malicious. Verdicts, redirect chains, and blocklists compared.
isMalicious vs GreyNoise: IP Noise Scoring and Threat Intelligence API Compared
GreyNoise tags internet background noise; isMalicious adds verdicts, WHOIS, DNS history, and ransomware context. A SOC-focused comparison for triage teams.
SSO Vishing And SaaS Data Theft: Domain Monitoring Before The Helpdesk Call
ShinyHunters-style SSO vishing shows how fake login domains, MFA enrollment abuse, and SaaS access can become data theft. Domain monitoring gives defenders early warning.
Mobile Smishing Defense: URL Scanners And Domain Reputation For July 2026
Mobile phishing keeps gaining operational relevance. Security teams need URL scanning, domain reputation checks, DNS pivots, and employee reporting workflows built for SMS and chat.
China Edge Device Campaigns: Passive DNS And Certificates For Early Warning
Dutch intelligence warnings about Chinese cyber capability reinforce a practical defense priority: monitor edge devices, VPNs, routers, DNS history, and certificate reuse.
When Vulnerability Exploitation Overtakes Credentials: CVE Prioritization In 2026
Verizon DBIR reporting highlights vulnerability exploitation as a top breach path. CVE Watch, KEV, EPSS, and exposure context help teams patch what attackers actually use.
Shadow AI Data Leak Defense: Monitor Domains, URLs, And Unsanctioned AI Apps
Shadow AI has become a governance and data leakage issue. Security teams need discovery, DNS visibility, sanctioned app controls, and domain monitoring around AI tool usage.
Agentic AI Threat Mapping: MITRE ATT&CK Needs Evidence-Rich Workflows
Anthropic mapped AI-enabled cyber activity to MITRE ATT&CK and found gaps around autonomous orchestration. SOC teams need AI summaries tied to evidence, not unsupported verdicts.
SOC Alert Fatigue In July 2026: Confidence Scoring Beats More Noise
Vectra AI research shows alert overload remains a resilience problem. SOC teams need source quality, confidence scoring, enrichment, and SIEM workflows that suppress noise without hiding risk.
Ransomware Revenue Is Rising: Initial Access Brokers Make Threat Intelligence Urgent
Q1 2026 ransomware revenue reporting points to a mature access market. Defenders need ransomware intelligence, domain monitoring, blocklists, and API enrichment before encryption begins.
AMOS macOS Infostealer: ClickFix Shows Why Hash Reputation Must Cover Developer Macs
AMOS and related macOS infostealers are turning social engineering into credential theft. File hash reputation, URL scanning, and domain intelligence help teams respond before stolen tokens spread.
BlueHammer Defender Exploitation: July 2026 Patch SLA For Windows Fleets
BlueHammer coverage shows why endpoint patching, CISA KEV context, CVE Watch, and IOC enrichment have to work together when local privilege escalation becomes ransomware tradecraft.
Arch AUR Rootkit And Infostealer Campaign: Supply Chain Defense Starts With Hash Intelligence
The June 2026 Arch User Repository compromise shows why supply chain security needs package review, file hash reputation, developer credential protection, and fast IOC enrichment.
Microsoft June 2026 Patch Tuesday: Turning 206 Vulnerabilities Into A SOC Priority Queue
Microsoft patched 206 vulnerabilities in June 2026, including publicly disclosed zero-days. Security teams need CVE Watch, KEV context, exploit evidence, and enrichment to avoid patch fatigue.
CISA KEV Adds Cisco, Chrome, And Arista Flaws: How To Prioritize Active Exploitation
CISA added Cisco SD-WAN, Google Chromium V8, and Arista EOS vulnerabilities to KEV in June 2026. Here is how SOC and vulnerability teams should turn that signal into action.
Oracle PeopleSoft Zero-Day: CVE-2026-35273 Shows Why CVE Watch Needs IOC Enrichment
The PeopleSoft CVE-2026-35273 exploitation reports show how vulnerability response, ransomware intelligence, IP enrichment, and incident response must work together.
Outsider Enterprise Takedown: AI Phishing Infrastructure Is Now A Domain Reputation Problem
The FBI, Google, and Black Lotus Labs disruption of Outsider Enterprise shows why AI phishing defense needs URL scanning, domain reputation checks, blocklists, and fast API enrichment.
Shadow AI Governance: How Security Teams Can Detect Risk Without Blocking Innovation
Shadow AI is the new shadow IT: fast adoption, weak visibility, and serious data leakage risk. Security teams need discovery, domain intelligence, policy, training, and monitoring.
AI-Enabled Cyberattacks and MITRE ATT&CK: Turning New Threat Maps Into SOC Action
AI-enabled threats are being mapped into ATT&CK language, but mapping is only useful when it drives enrichment, detection, triage, and response workflows.
Cyber Extortion Now Includes Physical Threats: What Incident Response Teams Must Change
Cyber incidents are no longer always contained to systems and data. As extortion crews add physical threats, responders need ransomware intelligence, safety escalation, IOC enrichment, and executive-ready evidence.
Subscribe to Our Newsletter
Weekly threat intelligence insights delivered to your inbox.