diff --git a/README.md b/README.md
index 3687eeb..8600168 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ Telegram bot that monitors cybersecurity RSS feeds and delivers real-time alerts
 rss_telegram_bot/
 ├── threat_intel_bot.py       # Main bot — commands, subscriptions, alert dispatch
 ├── rss_manager.py            # Feed fetching, dedup, message formatting
-├── content_classifier.py     # Severity/quality scoring, CVE/actor extraction
+├── content_classifier.py     # Severity/quality scoring, CVE/actor/malware extraction
 ├── check_feeds.py            # CLI utility to check feed health
 ├── feeds/
 │   ├── news_feeds.json
@@ -68,15 +68,42 @@ Each `feeds/*.json` file follows this structure:
 
 Add or remove feeds by editing the JSON, then restart the bot. Run `python3 check_feeds.py` to verify feed health before deploying.
 
+## Message Format
+
+Each alert follows this structure:
+
+```
+{emoji} Title
+
+Description
+
+📡 Source  ·  Published (UTC)
+🆔 CVE-2024-1234, CVE-2024-5678      (only if CVEs detected)
+👤 APT28, Fancy Bear                  (only if threat actors detected)
+🦠 LockBit, Cobalt Strike             (only if malware families detected)
+
+🔗 Read Full Article
+```
+
+The enrichment lines (CVEs, actors, malware) only appear when the classifier finds something — clean articles stay minimal.
+
 ## Classification
 
-**Severity** is keyword-based (title + description):
+`content_classifier.py` extracts the following from article title + description:
+
+**CVEs** — standard `CVE-YYYY-NNNNN` pattern matching.
+
+**Threat actors** — APT groups and named adversaries: APT28/29/40/41, Lazarus, Sandworm, Volt Typhoon, Scattered Spider, FIN7, and others defined in `THREAT_ACTORS`.
+
+**Malware families** — ransomware, C2 frameworks, loaders, stealers, and APT tooling: LockBit, Cobalt Strike, Emotet, QakBot, Sliver, PlugX, and others defined in `MALWARE_FAMILIES`. To add a family, append its display name to the set — matching is case-insensitive.
+
+**Severity** is keyword-based:
 - `critical` — zero-days, active exploitation, RCE, ransomware
 - `high` — privesc, auth bypass, code execution, kernel exploits
 - `medium` — XSS, CSRF, DoS, memory corruption
 - `low` — everything else
 
-**Quality score (0–100)** factors in: source reputation, content length, presence of CVEs, PoC indicators, threat actor mentions, MITRE techniques.
+**Quality score (0–100)** factors in: source reputation, content length, CVE presence, PoC indicators, threat actor mentions.
 
 Filter via env vars:
 ```env