Expel's 2026 Threat Report: Identity Accounted for 68.6% of Observed Incidents
Report discovered via Awesome Annual Security Reports.
Summary
Expel's analysis of nearly a million alerts from 2025 found identity involved in 68.6% of customer incidents. The report highlights stolen credentials, ClickFix malware delivery, trojanized productivity apps, and exposed cloud secrets.
Key points
- Expel's SOC triaged nearly a million alerts and investigated tens of thousands of incidents across its customer base in 2025; the findings reflect that customer population.
- Identity accounted for 68.6% of incidents. Security controls blocked access in 52.3% of identity incidents involving stolen valid credentials, while attackers gained access in 47.7%.
- Endpoints accounted for 29% of incidents. Malware represented 63.9% of endpoint incidents, and ClickFix social engineering accounted for 35.4% of malware-driven incidents.
- Expel observed trojanized PDF editors, utilities, and AI helper apps distributed primarily through advertisements. These apps could install backdoors, steal browser credentials, or expose uploaded documents.
- Cloud infrastructure accounted for 2.5% of incidents. Exposed secrets and unauthorized access were prominent issues, while red-team testing represented 32.2% of cloud incidents.
- The report describes Shai Hulud 2.0 harvesting cloud credentials, spreading through compromised npm packages, and injecting malicious GitHub Actions workflows to persist in build pipelines.
- Recommended defenses include phishing-resistant MFA, trusted-device access policies, approved application distribution, disabling package lifecycle scripts, short-lived cloud credentials, and requiring AWS IMDSv2.
Article Details
- Publisher
- Expel
- Report Period
- 2025
- Scope
- Security incidents across Expel customers, covering identity, endpoints, cloud infrastructure, industry exposure, and detection and response performance.
- Sample Size
- Nearly one million alerts triaged and tens of thousands of incidents investigated; exact customer and incident counts were not disclosed.
- Key Statistics
- Identity accounted for 68.6% of incidents, endpoints for 29%, and cloud infrastructure for 2.5%.
- Among identity incidents involving stolen legitimate credentials, 52.3% were blocked by security controls and 47.7% resulted in access.
- ClickFix accounted for 35.4% of malware-driven incidents observed in 2025.
- Customers averaged 13 incidents during 2025, with a median of three; average incident counts increased with organization size.
- Expel reported a current mean time to respond of 13 minutes for high- and critical-severity incidents when automatic remediation was enabled.
- Recommendations
- Enforce conditional access, prioritize trusted-device authentication for sensitive accounts, and adopt phishing-resistant FIDO2 MFA.
- Provide approved software distribution channels and use application allowlisting to block unauthorized remote management tools and trojanized productivity applications.
- Disable the Windows Run hotkey through GroupPolicy to reduce exposure to common ClickFix execution paths.
- Disable package lifecycle scripts, consider version pinning, and require MFA for publishing NPM packages.
- Scan for exposed secrets in CI/CD pipelines, replace long-term access keys with short-lived credentials, enforce least privilege, and automate revocation and rotation of exposed keys.
MITRE ATT&CK
T1059.001 · PowerShellBaoLoader executed PowerShell for antivirus enumeration and payload delivery; trojanized PDF editors also abused encoded PowerShell.T1078 · Valid AccountsAttackers used stolen legitimate credentials to attempt or obtain access to user accounts.T1098.005 · Device RegistrationAttackers registered new MFA devices on compromised accounts to extend access.T1105 · Ingress Tool TransferTrojanized PDF editors downloaded additional payloads onto compromised endpoints.T1114 · Email CollectionAttackers searched compromised mailboxes for internal communications.T1190 · Exploit Public-Facing ApplicationAttackers exploited server-side vulnerabilities to compromise systems and obtain network access.T1195.001 · Compromise Software Dependencies and Development ToolsShai Hulud 2.0 modified maintained NPM packages and used installation hooks to execute malicious code in developer and CI/CD environments.T1204 · User ExecutionClickFix tricked users into copying, pasting, and executing malicious commands; trojanized productivity applications also depended on user installation.T1496 · Resource HijackingAttackers deployed cryptocurrency miners such as XMRig on compromised cloud resources.T1518.001 · Security Software DiscoveryBaoLoader used PowerShell to enumerate antivirus software.T1539 · Steal Web Session CookieAdversary-in-the-middle phishing platforms intercepted authenticated session tokens and cookies.T1552.001 · Credentials In FilesShai Hulud 2.0 searched local configuration files for cloud credentials.T1557 · Adversary-in-the-MiddleTycoon 2FA and Evilginx were described as using intermediary or reverse-proxy infrastructure to intercept authentication.T1566 · PhishingPhishing emails directed users to credential-harvesting pages; phishing also targeted NPM package maintainers.T1567.001 · Exfiltration to Code RepositoryShai Hulud 2.0 exfiltrated stolen cloud keys to public GitHub repositories.
CVE
People
Chris WagnerDetection & Response Engineer who described five detections developed for malicious remote monitoring and management tool usage.Greg NotchExpel CSO who contributed a leadership letter emphasizing the gap between detection and response and shortcomings in basic security controls.Jake DownieSOC Analyst who explained the risks and persistence mechanisms of trojanized PDF editors.James ShankExpel Director of Threat Operations who contributed guidance on prioritization, security fundamentals, and identity-control implementation.Josh CarterManager, SOC Operations, who discussed detecting and blocking suspicious identity activity.
Threat Actors
Malware
BaoLoaderBaoLoader featured prominently in our malware detections in the second half of last year. In August, we observed it originating from PDF editingLummaIn 2024, we observed that Lumma infostealer was the most prominent infostealing malware by far, and the preferred infostealer of cybercriminals.Shai Huludworkflow’s logs, publicly exposing the secrets. In September and November, the Shai Hulud and Shai Hulud 2.0 worm (discussed more below)Shai Hulud 2.0workflow’s logs, publicly exposing the secrets. In September and November, the Shai Hulud and Shai Hulud 2.0 worm (discussed more below)StealCcriminals to navigate towards other infostealers such as Vidar and StealC.Vidarcriminals to navigate towards other infostealers such as Vidar and StealC.
Vendors
Products
Adobe ColdFusionSeveral different vulnerabilities used against Adobe ColdFusion serversAmazon Web ServicesThe tests in this category covered a wide range of technologies—including Amazon Web Services (AWS), Amazon Elastic Kubernetes Services (EKS),AzureCloud credential harvesting: The worm scans environment variables and local config files for AWS, Google Cloud, and Azure service principalGoogle CloudGoogle Cloud, Google Kubernetes Engine (GKE), and more. These tests also had a wide range of activities.KubernetesThe tests in this category covered a wide range of technologies—including Amazon Web Services (AWS), Amazon Elastic Kubernetes Services (EKS),Microsoft TeamsMost noteworthy targeted attacks in our data have been sustained campaigns using Microsoft Teams. This isn’t new—we’ve documented thisNext.jsThe threat to cloud infrastructure was particularly high because it affected core packages used by popular frameworks, like Next.js. That meant aWSUSA WSUS remote code execution vulnerability (CVE-2025-59287)
Tools
ClearFakecustomize other details. KongTuke and ClearFake are two major TDSs that are currently active and being tracked.Evilginxinfrastructure yourself. One of the best known PhaaS platforms is Evilginx. Evilginx provides a man-in-the-middle framework which can stealKongTukecustomize other details. KongTuke and ClearFake are two major TDSs that are currently active and being tracked.TruffleHog54% percent of the incidents were caused by attackers leveraging the automated secret scanning tool, TruffleHog. TruffleHog, when used,Tycoon 2FAThis can be a result of adversary-in-the-middle (AiTM) platforms. Phishing-as-a-service (PhaaS) tools like Tycoon 2FA use reverse proxiesXMRigIn these cases, attackers often deploy cryptominers like XMRig. XMRig is a legitimate, open source, cryptocurrency miner often used to mine
Industries
Financial ServicesManufacturing, financial services, and healthcare are the top three industries that saw the most incidents, respectively. However, healthcareHealthcareManufacturing, financial services, and healthcare are the top three industries that saw the most incidents, respectively. However, healthcareManufacturingManufacturing, financial services, and healthcare are the top three industries that saw the most incidents, respectively. However, healthcare