Weekly threat-intel roadmap — 2026-07-05

[alekslinde]

Summary

Weekly threat-intelligence roadmap for Just Checking, Mate. Adds docs/threat-intel/2026-07-05-threat-roadmap.md — research and proposals only; no detection code (lib/) is modified.

All items from the 2026-07-01 roadmap (issues #63–#68) are fully implemented and closed. This run identifies 8 new threats with 6 HIGH-priority detection improvements proposed.

Top recommendations this week

Priority	Recommendation	Issues
1	Tax-time cost-of-living lures — "cost of living payment", "energy rebate", "tax recalculation" added to URGENCY_WORDS; peak scam season starts now	#73
2	ClickFix "run a command" social engineering — "press Win+R", "paste this command", PowerShell lure phrases; ACSC advisory 7 May 2026; zero existing coverage	#74
3	Device code / OAuth phishing language in checkEmail — "enter device code", microsoft.com/devicelogin; escalated from watchlist to HIGH after FBI PSA260521	#75
4	WhatsApp investment group pig-butchering — new composite for "join our trading group", "VIP trading signals"; ASIC 26-063MR joint alert, $35.8M AU losses	#76
5	New suspicious TLDs: .zip, .mov, .lat — trivial addition to SUSPICIOUS_TLDS	#77
6	SMS "Unverified" label override language — scammers explaining away ACMA's new Sender ID Registry "Unverified" display; AU-specific, near-zero FP	#78

Watchlist items (no code change needed yet)

• myID rebrand — myGov digital identity layer rebranding to myID; watch for myid-verify[.]com.au typosquats
• Numeric sender ID bypass — ACMA regime covers alphanumeric IDs only; scammers may shift to numeric spoofing
• International SMS routing — non-AU carriers not bound by ACMA; expect increased foreign-gateway smishing
• AI-generated pig-butchering (grammar signal deprecation) — agentic AI produces flawless prose, eroding value of typo detection
• Fake banking app reinstallation lure — "delete and reinstall your bank app from this link" (MEDIUM; Rokarolla malware, June 2026)

Linked issues

#73 #74 #75 #76 #77 #78

---

Generated by Claude Code