Threat research
We track criminal infrastructure, attack tooling, fraud methods and digital-risk change, turning frontline observations into research that can be searched, cited and used.
Featured research
Read the evidence, findings and practical considerations behind changing external risk.
One script, five infant-formula brands named at once. Product-line nicknames instead of brand names, questions instead of claims, and RMB 0.25–0.4 (US$0.04–0.06) per ordinary negative comment. Threat Hunter tracked 613 paid attack tasks in September 2026. What they show is a piece-rate business built to look like genuine customer experience.
Read the English publicationResearch library
Browse reviewed English translations and substantive briefs. Every item links directly to its corresponding Chinese source without a lead form.
All published research
Found 40 items · showing 12 items
As of 29 September 2026, Threat Hunter reviewed 169 public posts and coded 143 transaction amounts. The assessment focuses on attackers obtaining Apple Pay device PANs (DPANs) in bulk and submitting them into card-not-present channels where token scope and cardholder authentication were not enforced.
Read the English publicationA single comment can look like ordinary customer feedback. In a task pipeline, it can also be a deliverable: a target post, a required action, proof of completion, then settlement. Threat Hunter monitored 20,000+ related items over roughly one month and identified 1,500+ tasks. Of those, 1,196 were comment tasks; 815 were negative comment tasks — 68.1% of all comment tasks.
Read the English publicationData Leakage Trends and Dark Web Risk Migration Lending Data Leakage, Supply Chain Exposure, and Continued Abuse Commercialization of Illegal Financial Information Lookup ServicesIn H1 2026, Threat Hunter verified 23,645 data leakage incidents involving 3,426 organizations. The report examines the growing concentration of high-risk data on the dark web, lending-data leakage across third-party supply chains, and the commercialization of illegal personal information lookup services. It also traces how leaked data is repeatedly resold and used for fraud, fake debt collection, targeted marketing, and profile enrichment.
Read the English publicationHalf are gone in 30 days. Three in ten return after 90. Threat Hunter monitored 48,222 SMS-receiving numbers in July 2026: 56% appear once or span 30 days or less, and 32.7% are seen again after 90 days. These numbers are shelf inventory, so judge them on last-seen.
Read the English publicationThreat Hunter tested 8 automation devices against real human input and collected 75,000+ operation events across 9 dimensions. A robotic arm can already look human on a single signal. Combinations of contact area, trajectory, and pressure are harder to fake. Dataset and method are open-sourced.
Read the English publicationA half-year assessment of increasingly realistic, coordinated credit fraud across professional debt assumption, mortgage, business, auto, and consumer lending.
Read the English publicationA half-year view of the channels, assets, and tactics behind brand impersonation, phishing, counterfeit distribution, and related external risk.
Read the English publicationA half-year assessment of changing cybercrime infrastructure, malicious mobile-number resources, attack tools, and increasingly specialized fraud operations.
Read the English publicationA global review of identity and document abuse, automated attack tools and services designed to bypass KYC controls.
Read the English publicationA global e-commerce study covering seller and buyer account abuse, promotion fraud, payments and criminal supply chains.
Read the English publicationA 2025 landscape of verified data exposure, changing illegal-trading channels and emerging financial and messaging risks.
Read the English publicationAn annual assessment of fabricated identities and data, fraudulent intermediaries and organized credit-application fraud.
Read the English publicationShowing 12 / 40
From research to protection
Identify new attack patterns across multiple external risk signals
Validate material findings through analyst review and relevant scenarios
Turn research into intelligence labels, detection capabilities and response workflows
Start with the business risk
Connect the research topic to the market, workflow and risk objective that matters to your team.