Proofpoint Threat Research

https://www.proofpoint.com/us/blog/threat-insight

added as candidate 2026-07-15: served as the primary for the Entra ID OAuth client ID spoofing entry (UNK_pyreq2323 / UNK_OutFlareAZ); recurring identity/threat-insight research authority. Promote to active after 3 contributing runs. | 2026-07-26 weekly quality audit: promoted candidate → active on the documented lifecycle bar (cited by published entries from 11 distinct runs; the bar is 3). The promotion had never been executed because nothing counted contributing runs, the digest now emits sources.promotion_due (tools/run_summary.py). | 2026-09-13 quality audit (G3 broken-recipe duty, closing 2026-09-06 recommendation 3): RECIPE FIXED. The recorded url was already correct; the failure was a plain WebFetch whose summariser lost the listing, which read as 'resolves to the corporate newsroom'. VERIFIED WORKING: `python3 tools/fetch_source.py extract https://www.proofpoint.com/us/blog/threat-insight` returns the real Threat Insight listing; top article this run 'Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days', 2026-09-09. fetch_method webfetch -> bridge (the `extract` subcommand). | 2026-10-02 (2026-10-02T0404Z-intel): `extract` returns raw HTML (direct-raw); `url` raw HTML parses cleanly with <time datetime> tags.