diff --git a/clusters/tool.json b/clusters/tool.json
index 5077d34..660ea99 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -2962,6 +2962,15 @@
           "https://www.welivesecurity.com/2017/08/22/gamescom-2017-fun-blackhats/"
         ]
       }
+    },
+    {
+      "value": "Fireball",
+      "description": "Upon execution, Fireball installs a browser hijacker as well as any number of adware programs. Several different sources have linked different indicators of compromise (IOCs) and varied payloads, but a few details remain the same.",
+      "meta": {
+        "refs": [
+          "https://www.cylance.com/en_us/blog/threat-spotlight-is-fireball-adware-or-malware.html"
+        ]
+      }
     }
   ]
 }