MFSA Cyber Threats Awareness Brief: 2025 trends, Jan-May 2026 and H2 2026 outlook

In two minutes

• The Malta Financial Services Authority (MFSA) reviews cyber threat trends for 2025 and January to May 2026 for regulated firms ('Authorised Persons'), using public sources only (executive summary, p. 4).
• AI-driven and AI-enabled attacks were the largest root-cause category in the 2026 register, followed by exploited vulnerabilities and exposed infrastructure (pp. 13-14).
• Supply-chain and developer ecosystem compromise made up 13% of 2026 observations, including malicious packages on npm, PyPI and GitHub Container Registry (p. 14).
• Identity remains a decisive control layer: the brief says to assume some credentials are exposed and to move beyond password-only thinking (p. 10).
• ICT third-party concentration is treated as a systemic resilience issue. Direct oversight of the 19 designated critical providers under DORA does not transfer responsibility from the firm (p. 11).
• The H2 2026 outlook names six themes: faster AI-accelerated exploitation, supply chains, DORA concentration visibility, deepfake-enabled social engineering, geopolitical disruption and post-quantum preparedness (chapter 5).
• The brief says it adds no new obligations. It reminds firms of their duty under DORA article 8(2) to assess exposure to developing threats (pp. 5-6).

Key numbers

• 70: open-source threat observations assessed for January to May 2026 (p. 12).
• 26%: share of 2026 observations rooted in AI-driven or AI-enabled attacks, the largest category (p. 13, figure 2).
• 23%: share of observations in exploited vulnerabilities and exposed infrastructure, as read from the chart (p. 13, figure 2).
• 13%: share of observations in supply-chain and developer ecosystem compromise (p. 14).
• 10, 14, 11, 20, 15: monthly observation counts, January to May 2026 (p. 12, figure 1).
• 4,875 incidents; 4.7% finance: incidents analysed by ENISA for July 2024 to June 2025, and finance's share (p. 9).
• 488: publicly reported finance-sector incidents in ENISA's finance report (January 2023 to June 2024) (p. 9).
• 19: critical ICT third-party providers designated under DORA in November 2025 (p. 11).

What to do with it

• Treat patch management as a time-sensitive capability: risk-based prioritisation, named owners, compensating controls and reporting on overdue critical vulnerabilities (pp. 14, 19).
• Review identity controls across workforce, privileged and service identities, and customer authentication, including phishing-resistant MFA, OAuth consent governance and session revocation (pp. 10, 16).
• Harden software supply chains with dependency pinning, provenance checks, secrets scanning, build isolation, code signing and multi-person approval for critical builds (pp. 15, 20).
• Test exit strategies and concentration risk at several levels, and do not rely only on supplier questionnaires (p. 20).
• Add callback procedures, dual approval and independent verification to high-risk payment and account-change workflows to counter deepfakes (p. 21).
• Build an inventory of cryptography use and AI systems, and run scenarios that combine DDoS, third-party outage, phishing and disinformation (pp. 17, 19, 22).

Read the full document if

• you supervise or run security at a regulated financial firm, especially in Malta or the EU, and need a regulator's view of threat priorities
• you are preparing board reporting, scenario design or a DORA-aligned risk register update for the second half of 2026
• you want the source list, including CERT-EU briefs and ENISA reports, behind the 2026 threat picture

What it relies on

The brief rests on public open-source material only, sorted into three tiers by authority (section 2.1, p. 7). For 2025 it uses 22 report-level entries from ENISA, the ECB, the ESAs and industry vendors. For January to May 2026 it uses 70 observations, mainly from CERT-EU Cyber Briefs: 53 Tier 1, 12 Tier 2 and 5 Tier 3. The authors say it is not an incident census, that public reporting is uneven, that vendor data reflects their own customers, and that 2026 metrics are indicative (pp. 4, 8, 12). The MFSA is the financial regulator and does not sell products. It also cites its own Supervisory Priorities 2026.

Our read

Useful as a regulator's compact reading list and planning frame for DORA-covered firms. The counts show what was publicly reported and screened for relevance, not how often attacks happen. The H2 2026 chapter pairs each theme with a short list of controls.