Method notes on threat intelligence
How to move from a source to a citable claim without turning an indication into a conclusion. These notes explain the Atlas’s editorial approach, its five declared guarantees and how to read a historical evidence register.
This page does not promise continuous monitoring or certify the entire dataset. It explains what a claim requires before publication and which reservations must accompany it. To see these limits applied to counts, consult the documented countries and coverage gaps.
From reference to claim
Reading a source means more than saving its link. Citing it requires retaining who published it, when, what it describes and how far its evidence reaches. A regional mention, a malware family and a confirmed incident are not interchangeable units.
The editorial reading separates three layers: what the document supports, the interpretation drawn from it and what remains undetermined. A missing country, date or relationship must not be supplied by intuition. A hypothesis may be recorded as a hypothesis; it must not take the place of a fact.
The note on dataset citability develops these conditions. The register below shows how selected claims were recorded, including dates and reservations, without turning that selection into a census of all available evidence.
Pressure signal
Financial fraud does not arrive through a single door.
The entry, intervention and persistence sequence is a reading framework. A campaign may combine a phone, browser, kit and banking session, but the illustration does not prove a shared chain or operator across cases. Each investigation needs source-supported relationships.
Entry
Phishing, smishing, social networks and institutional-looking lures that aim to open the first interaction.
What makes a financial malware dataset citable
Inclusion criteria, documentary data date and the limits of the counts.
The question and evidence determine publication
A note is justified when it answers a specific question using reviewable sources and visible limits. Publishing more frequently does not replace those conditions. An advisory date, the date of the described event and an editorial revision date must remain distinct.
Five declared guarantees and how to read them
These are the site’s editorial commitments, not an external certification result. This page does not detail the complete internal structure or curation procedure. Each guarantee should be checked against the reference or version being used.
A technical claim should point to a dated reference. The link locates the document; it does not authorize extending what that document demonstrates.
A point unsupported by the source remains undetermined. Separating interpretation avoids presenting an editorial conclusion as the vendor’s statement.
The figure should be tied to the index of the same version. A count of documented families is not a count of infections, victims or losses.
The version and additions should be identified so another reader knows what was cited. A website revision date does not retrospectively change the observation period.
The site declares human review before data inclusion. That declaration does not remove errors or establish a second independent review of every row.
Historical evidence register
The table preserves the nine rows and their states from the supplied version, with checks recorded as of September 19, 2026. It is not a current validation of every source. R-04 retains a Pix figure awaiting a fresh documentary check; R-08 retains a corpus search result, not a regional absence; R-09 remains unverified. Clarifications for R-05 and R-07 are separated below the table.
| ID | Recorded claim | Reference | Reference date | Limit | Verification |
|---|---|---|---|---|---|
| R-01 | PlayPraetor target distribution: Europe 58%, the Americas 12%, with Peru among the main targets; growth tied to Spanish-speaking targets. | Cleafy · PlayPraetor | Vendor figures: not a measure of regional prevalence and not cross-checked against another source. | Verified 2026-09-19 · page opened and read | |
| R-02 | Fake emails invoking AFIP (a pending fine, a ZIP with VBS) drop Grandoreiro; waves in 2025 in Spain, Argentina and Mexico. ARCA warns that no communication invoking AFIP is official. | ESET · Grandoreiro / AFIP | It describes observed campaigns; the dataset holds no victim count for this claim. | Verified 2026-09-19 · page opened and read | |
| R-03 | Blind Eagle targets Colombian judicial and government institutions with .url files imitating summonses; a December 2024 campaign with more than 1,600 victims. | Check Point Research · Blind Eagle | The figure refers to one campaign, not to the actor's total activity. | Verified 2026-09-19 · page opened and read | |
| R-04 | Pix in 2025: 79.8 billion transactions (+25.7%). | Banco Central do Brasil · Relatório de Gestão do Pix 2023–2025 | An official payment-volume figure; it does not measure fraud or malware incidents. | Verified 2026-09-19 · PDF read | |
| R-05 | PromptSpy, presented by ESET as the first known Android malware to abuse generative AI: it uses Gemini for persistence; a case in Argentina. | ESET · PromptSpy | "First" is ESET's claim at the date of its report; the site attributes it to the source and does not generalize it. | Verified 2026-09-19 · page opened and read | |
| R-06 | Operation against Grandoreiro: five administrators arrested in Brazil in January 2024, with support from Trend Micro, Kaspersky, Group-IB and Scitum. | INTERPOL · Grandoreiro | The operation did not end the activity: Kaspersky (2024-10-22) states that the remaining operators are still active. | Verified 2026-09-19 · page opened and read | |
| R-07 | Balonx, a PhaaS operated from Mexico with weekly rental: more than 350 domains and more than 20 institutions. | Group-IB · Balonx | Vendor figures at the date of its report; domains and credentials are not a measure of prevalence. | Verified 2026-09-19 · page opened and read | |
| R-08 | Reports of deepfake-media fraud schemes have risen since 2023: generative AI is used to create fake documents, photos and videos. | FinCEN · Alerta FIN-2024-Alert004 | An alert about the U.S. financial system, not a measurement of LATAM; no LATAM profile in the dataset mentions facial biometrics or deepfakes (0 matches in the 2026-09-19 search). | Verified 2026-09-19 · PDF read | |
| R-09 | Alerts from Peru's CNSD included in the set of institutional alerts. | CNSD Perú · alerts 301-2025 and 330-2026 | no date stated | Not verified: access returned a 403 error and searches gave no result. The site only says they complete the set; it is not used for any figure. | Not verified as of 2026-09-19 |
Reading clarifications: R-05 and R-07
R-05 · PromptSpy. ESET describes indications of targeting Argentina, but says it had not observed the malware in its telemetry and considers a proof of concept possible. “A case in Argentina” should not be read as a local infection confirmed by that vendor.
R-07 · Balonx. Group-IB attributes more than 350 domains to “Aclaraciones Banciaras” and Balonx together. The entire set should not be assigned exclusively to Balonx. The historical row remains visible to identify this difference, not to renew its validation.
What to check before reusing a data point
Return to the document, check its scope and cite the dataset version used. When comparing countries, do not distribute a “LATAM” label among jurisdictions the source does not name. When comparing techniques, do not merge families or operators simply because they share vocabulary.
The synthesis on Grandoreiro and the Windows front illustrates another distinction: activity documented after an operation is not a real-time activity check. The method is to maintain that distance between evidence and conclusion.