Weekly threat-intel roadmap — 2026-08-02

[alekslinde]

Summary

Weekly automated threat-intelligence run for 2026-08-02. Adds the roadmap document tracking 9 new/evolved scam tactics observed in July–August 2026, with 10 detection proposals mapped to lib/scamDetector.ts and 6 GitHub issues filed for HIGH-priority work.

What's in this PR

• docs/threat-intel/2026-08-02-threat-roadmap.md — full roadmap with executive summary, threat details, IOCs, detection proposals (D1–D10), watchlist, and 30+ sources

No code changes — this PR is documentation only. Implementation work is tracked in the issues below.

Threats covered (T1–T9)

#	Tactic	Priority
T1	ngrok ephemeral tunnels (evasion, phishing delivery)	HIGH
T2	github.io / netlify.app free-hosting abuse	HIGH
T3	Energy utility impersonation — AGL, Origin Energy	HIGH
T4	Voicemail notification lures (SMS/email)	HIGH
T5	AU crypto exchange impersonation — CoinSpot, Swyftx, Binance	HIGH
T6	ATO tax debt / audit coercion variant	HIGH
T7	Health insurer impersonation — Medibank, Bupa, nib, HCF	MEDIUM
T8	State road authority spoofing — VicRoads, Revenue NSW	MEDIUM
T9	PhaaS kit evolution — Whisper 2FA / LogoKit (context only)	MEDIUM

Issues opened

• [threat-intel] Add ngrok.io / ngrok-free.app to SUSPICIOUS_HOSTING #119 — Add ngrok.io / ngrok-free.app to SUSPICIOUS_HOSTING
• [threat-intel] Add github.io and netlify.app to SUSPICIOUS_HOSTING #120 — Add github.io and netlify.app to SUSPICIOUS_HOSTING
• [threat-intel] Detect energy utility impersonation — AGL, Origin Energy, EnergyAustralia #121 — Detect energy utility impersonation (AGL, Origin, EnergyAustralia)
• [threat-intel] Detect fake voicemail notification lures in checkSms / checkEmail #122 — Detect fake voicemail notification lures in checkSms / checkEmail
• [threat-intel] Detect AU crypto exchange impersonation — CoinSpot, Swyftx, Binance #123 — Detect AU crypto exchange impersonation — CoinSpot, Swyftx, Binance
• [threat-intel] Add ATO tax debt / audit threat language to URGENCY_TAXTIME #124 — Add ATO tax debt / audit threat language to URGENCY_TAXTIME

Carry-forward

• Issue [threat-intel] Detect PDF-embedded QR code "Scanception" hybrid body signal #113 (PDF-embedded QR / Scanception) from 26 July run — still open
• Proposals D8–D10 (customs parcel language, health insurers, state road authorities) deferred to MEDIUM priority; no issues filed this run

---

Generated by Claude Code