Christine Billie

Rapid response | 8 min read

Fake Claude Code extensions in Cursor: Malicious activity after the exposure window

A fake Claude Code extension in Cursor’s marketplace planted SSH backdoors on developer machines. See what Expel found and how to check every machine.

Rapid response | 4 min read

Storm-0940 ARTEX attacks: ConnectWise app abuse and Okta sign-ups

Storm-0940 used ARTEX AI agents to abuse ConnectWise apps and Okta self-registration. Get the IOCs, detection guidance, and steps to take now.

Rapid response | 5 min read

Php2Shell PHP vulnerabilities: Unauthenticated RCE and fixes

Php2Shell is a pair of critical PHP RCE flaws that let attackers run code without logging in. Expel analyzed it in October 2026. Includes patch versions, detection guidance, and mitigations.

Rapid response | 7 min read

QuartzLine: A working PDF viewer with a backdoor inside

QuartzLine is a working PDF viewer with a backdoor inside, spread in part through Google Ads. See what it does in real environments, plus IOCs.

MDR | 11 min read

Beware QR code phishing, subscription bombing, and other holiday phishing scams

Don't let cyber Grinches steal your holidays. Be aware of phishing scams targeting your data and credentials this season.

Current events | 2 min read

How we spotted it: A Silicon Valley Bank phishing attempt

We’re starting to spot fraud attempts in the wake of SVB’s collapse. Learn how we spotted one attempt through a custom detection.