ESET H1 2026: ClickFix surging, AI-branded malware plugins rising, EDR killers now standard attacker toolkit. Pattern: all designed to blind detection. None of them change what the infrastructure they run on looks like in real-time abuse telemetry. #ThreatIntelligence #CyberSec

Phishing consumes 36.5% of security teams' time. $51,948 per analyst per year — and growing. 82% of 3.4B daily phishing emails are AI-generated. The attack cost collapsed. The defense cost didn't. #EmailSecurity #ThreatIntel

1 in 10 new domains registered in 2025 ended up on a blocklist. 8 registrars were responsible for 92% of them. Domain aging buys time. Real-time threat intel closes the gap when they go live. #ThreatIntel #DomainAbuse

PCPJack cloud worm: 230+ hijacked servers across AWS, GCP, Azure — one persistent SMTP relay network. Every 60 seconds the worm tests its tunnels. It's optimizing specifically to pass IP reputation checks. Behavioral signals catch what static lists miss. #CloudSecurity #ThreatI

DORA went live. ESAs just published 3,383 major ICT incidents across EU financial institutions in 2025. June 2026: informal regulatory tolerance is over. If you supply ICT services to EU banks, they need documented proof of your real-time resilience. Not policy. Proof. #DORA #C

QR phishing up 146%. Content scanners can't read images. But the sending IPs and landing page domains still leave tracks. Network-layer reputation catches what content filters miss. #Quishing #ThreatIntel #Abusix

Median patch time: 43 days (up from 32). Vuln exploitation: now the #1 breach vector. For ISPs: every slow-patching customer is a future abuse origin. You need to see it before the complaints arrive. #DBIR2026 #CyberSecurity #Abusix

5,500+ GitHub repos poisoned in one automated wave via hijacked Actions tokens. Scale attacks leave infrastructure tracks. Real-time abuse data sees the wave before the reports land. #SupplyChain #ThreatIntel

The FBI warned about Kali365 PhaaS: bypasses MFA via OAuth token theft. Content filters didn't catch it. The sending infrastructure still left tracks. It always does. #PhishingAsAService #ThreatIntel

cPanel CVSS 9.8 — 70M+ domains, actively exploited, CISA KEV listed. Under NIS2, hosting providers are essential entities. "We were patching" doesn't stop compromised servers from becoming spam infrastructure. Abuse intelligence closes that window. #NIS2 #CyberSecurity

232% more malicious domains in 6 months. AI spins up phishing infra faster than any team can track it. Your blocklist is either alive — or it's already obsolete. #ThreatIntelligence #EmailSecurity #Abusix

Glassworm botnet: infected devs via VSCode extensions, npm packages, GitHub repos. C2 infrastructure ran for months. Attack chains change. The IPs and domains running them don't. Real-time reputation data is still the fastest signal. #CyberSecurity #ThreatIntel

AI phishing up 1,265% in a year. Click-through: 54% vs 12% for traditional lures. Attackers scale content with AI. They also scale infrastructure with automation. Complaint-driven detection can't keep up. Real-time IP behavioral signals can. #Phishing #AI #Infosec

Article 19: handle DNS abuse through legal process first. Minimal intervention. Meanwhile malicious domains in safe-haven jurisdictions operate for months while courts deliberate. Real-time DNS threat intel doesn't wait for judicial calendar time. #DNS #AbuseOps #Infosec

Amazon SES abused for phishing. SPF pass. DKIM pass. DMARC pass. When attackers build their infrastructure to pass your filters by design, authentication is no longer the defense. Behavioral signals are the layer that still works. #EmailSecurity #Phishing #Infosec

Google. Yahoo. Microsoft. All mandated DMARC. Result: 9% of domains at p=reject. 91% still spoofable. Authentication without enforcement doesn't protect anything. It just creates an audit trail. #DMARC #EmailSecurity #Infosec

Multiple critical CVEs in dnsmasq — cache poisoning, RCE, privilege escalation. Fixed in 2.92rel2. The catch: dnsmasq is in millions of ISP-provisioned routers and embedded devices. You can't patch what you don't know you're running. Know your stack. #DNS #Infosec #NetworkSecu

46% of global spam now comes from compromised accounts on Gmail, Outlook, and SaaS platforms. SPF/DKIM/DMARC all pass. IP reputation: clean. Standard defenses: blind. What catches it: real-time abuse signals from actual receiving infrastructure. #EmailSecurity #ThreatIntel #IS

369K devices. 163 countries. Years of operation as anonymous attack proxies. SocksEscort ran on ISP and hosting networks without detection. Real-time IP reputation finds infected devices before law enforcement does. #ISP #BotnetTakedown #Cybersecurity

Microsoft: 35K phishing victims, 13K orgs, 26 countries — in 3 days. Sent through legitimate services. SPF/DKIM/DMARC passed clean. QR code phishing is the fastest-growing 2026 attack vector. Static reputation can't scan behind a QR image. #Phishing #ThreatIntel #Infosec