A self-propagating npm supply chain worm compromised keyv, cacheable, flat-cache, file-entry-cache, and 800+ downstream packages—stealing CI/CD, cloud, and API credentials along the way. (1/6)

In April 2026, a Chinese cybercrime group accessed a support rep's device at DigiCert—then used that access to steal code-signing certificates meant for DigiCert customers. We're calling the actors CylindricalCanine. 🧵 1/4

Researchers at Sysdig found JadePuffer used an LLM agent to conduct a ransomware attack. Is this future of ransomware? In this case, a human still steered it and struggled with the basics. expel.com/blog/the-fir...

The “first” fully agentic ransomware is here, but we aren’t panicking (yet): Meet JadePuffer

Analysis of agentic ransomware JadePuffer: human operator, LLM agent limits, and why fundamentals still protect defenders.

expel.com

The Gentlemen ransomware, in a BYOVD attack, used a zero-day exploit to kill EDRs before deploying their payload. The driver they abused wasn't on any public blocklist. Here's our analysis of their techniques. 🧵

Need a high-level overview of the latest Mini Shai Hulud? Aaron Walton breaks down how the latest supply chain attack happened, what defenders should do now, and prepare for the next one. www.youtube.com/shorts/7x9t6...

Mini Shai-Hulud: the wormable attack targeting your supply chain

YouTube video by Expel

youtube.com

By now you've probably seen the Mini Shai Hulud supply chain story. TeamPCP compromised 170+ npm and PyPI packages—TanStack, Mistral AI, OpenSearch, and more. Here's what you need to know if you're responding right now. (1/7)

Beware of what you copy and paste. In March 2026, a new watering hole attack called "InstallFix" accounted for 13% of all malware incidents we observed. The lure? Fake install pages for Claude Code. Here is how it works and how to defend your environment. 1/7

The Axios npm package is a component of many popular applications. Its compromise in turn impacted a lot of systems and software that relied on it. The package was actively serving a remote access trojan to Windows, macOS, and Linux systems. 1/3

Iran's cyber capabilities — ransomware, data wipers, stated intent to target Western infrastructure — aren't theoretical. Expel's James Shank and Iran intel expert Steph Shample give security teams the straight picture: what's real, what it means, and what to do about it. expel.com/resource/ira...

Iran cyber threats: What security teams need to know right now | Expel briefing | Expel

What security teams need to know about Iran cyber threats. Expert insights on Iranian capabilities, TTPs, and defensive measures to implement today.

expel.com

We continue to see high volumes of targeted phishing via Microsoft Teams. The following are malicious senders just from this past week: Corporat[@]HelpDeskFoundation[.]onmicrosoft[.]com service[@]helpdeskfoundation[.]onmicrosoft[.]com helpdesk[@]omkarcis[.]online 1/5

Security and finance leaders think they're aligned. Our new research with 300 of them says otherwise. 54% of finance leaders need strategic alignment metrics. Security's giving them maturity metrics instead. The language barrier is real—and fixable. expel.com/blog/new-res...

We just dropped a new AI upgrade 🫳 Now you get plain-English explanations for every detection rule. See exactly which rules are firing, how your coverage evolves, and what's actually protecting you. Transparency isn't a feature, it's how MDR should work. expel.com/blog/new-exp...

New Expel AI upgrade: “Pop the hood” on our detection strategies

Expel added new AI-generated descriptions to our detection rules, written in plain English, to improve transparency and understanding.

expel.com

We're seeing XMRig cryptominers popping up everywhere recently. Threat actors love them because they’re a simple way to make money, and they can go unnoticed. Here's how to spot them and shut them down before threat actors start monetizing: expel.com/blog/on-the-...

On the radar: Weeding out XMRig

XMRig is a cryptocurrency miner considered less malicious than other threats, but it's still worth prioritizing.

expel.com

Our security leaders made their (brutally honest) 2026 predictions. The one thing they agree on? AI isn’t going anywhere, and it’s bringing new capabilities and threats into the new year. Read all of their unfiltered takes: expel.com/blog/cyberse...

Our cybersecurity predictions for 2026

Our experts and leaders are sharing their predictions for cybersecurity trends in 2026 to help you start strategizing.

expel.com

Your analysts are drowning. You can't hire fast enough. And even if you could, the math doesn't work. The economics of running a 24×7 SOC have changed. Use our free calculator that shows you what your team needs whether that's building, buying, or augmenting: expel.com/blog/buildin...

Why building a 24x7 SOC is getting harder (and what actually works instead)

The math on building an in-house SOC has changed, including the real costs, why retention is brutal, and what actually works.

expel.com

In the SOC, you get used to the noise. But a couple weeks ago, a single string cut through the noise: SHA1HULUD. It felt like seeing a ghost. We traced the activity to a public GitHub repository where the customer's private cloud keys and secrets were exposed for anyone to grab.

Expel MDR now supports Panther. We integrate with your cloud-native SIEM, bringing our detections, 24x7 monitoring, and incident response to work alongside what you've already built. Use the tools that work for you. We'll make them work harder. expel.com/blog/more-si...

More SIEM flexibility: Expel MDR adds support for Panther

Expel announces support for Panther's cloud-native SIEM as the latest in our long list of advanced integrations.

expel.com

⚠️ Attackers are buying Google Ads that appear when looking up how to troubleshoot your Mac. The ad takes you to a shared ChatGPT chat that tells you to copy-paste some code. You've just executed malware. Kroll has a solid write-up on the mechanics: www.kroll.com/en/publicati...

Part two of our QTR, Q3 2025 just dropped: malware disguised as apps that actually work. BaoLoader hides backdoors in PDF editors and browsers. TamperedChef is a recipe app with hidden command codes. These apps function as promised, which is why users don't suspect anything.

Imagine searching for Microsoft Teams, visiting the link at the top of the results, & getting hit with malware. That's the malvertising campaign that the Rhysida ransomware gang has been running. Expel Intel is tracking this campaign. Here's what we've uncovered: www.theregister.com/2025/10/31/r...

Ransomware gang runs ads for Microsoft Teams to pwn victims

: You click and think you're getting a download page, but get malware instead

theregister.com

Q3 2025 Threat Report is out. We analyzed thousands of real incidents across customer environments. Here’s what stood out: 73.9% of all incidents were identity-based attacks. Up from 67.6% last quarter. Let’s dive into the Q3 numbers 🧵

The Rhysida ransomware gang (formerly Vice Society) is running the same playbook as last year—buying Bing ads to deliver fake Microsoft Teams, PuTTy, and Zoom downloads. Click the wrong sponsored result? You’ve just installed OysterLoader, their initial access malware.

⚠️Attackers are actively exploiting CVE-2025-59287, a recently identified vulnerability in WSUS. Successful exploitation allows an attacker to run code using SYSTEM privileges. Expel caught & contained incidents related to this in two customer environments this AM. Details: expel.com/blog/wsus-re...

Attackers found a clever way to abuse legitimate, digitally signed software to load malware and it's working. Expel Intel’s Marcus Hutchins (@malwaretech.com) breaks down a campaign that weaponizes Greenshot, a legit screenshot tool, to evade detection at multiple layers. 🧵

Halloween might be the spookiest day in October but this month's Patch Tuesday is a close second. 175 new CVEs from Microsoft, 8 marked critical, 6 zero-days, 2 already exploited in the wild. But not to fear, our threat intel team breaks down the 3 you should patch first. expel.com/blog/patch-t...

Patch Tuesday: October 2025 (Expel’s version)

This month, we're highlighting top critical vulnerabilities, including six zero-day vulnerabilities, and one in Cisco IOS.

expel.com

⚠️ Our threat intel team just caught attackers using a clever new trick to bypass security tools: cache smuggling. Instead of downloading malware, they hide it in fake images that browsers automatically cache. Then PowerShell extracts and runs it—no web requests needed.

The security industry is drowning in threat feeds that don't actually help you stop attacks. We've been working to fix that for years. Today, we’re taking the wraps off our expanded threat intel program: Expel Intel. (1/7)

50k events/day. 0.1% true positive rate. 50 real threats buried. That's what happens when you optimize for integration count, not detection quality. Vendors brag about "300+ integrations" while analysts burn out investigating false positives. Start counting what matters: expel.com/blog/stop-co...

Your email security quarantined the malicious email. 🚨📧 Victory, right? Not quite so. Several employees already clicked the link and installed attacker-controlled tools.