Cybersecurity threat intelligence
and research

Real attacks. Real analysis. Zero fluff.

Check out the latest

View all articles
Cache smuggling: When a picture isn’t a thousand words
October 8, 2025  |  Marcus Hutchins

Cache smuggling: When a picture isn’t a thousand words

We recently observed an innovative campaign using the ClickFix attack tactic for cache smuggling. Here's what you need to know.
The history of AppSuite: the certs of the BaoLoader developer
September 11, 2025  |  Aaron Walton

The history of AppSuite: the certs of the BaoLoader developer

We're tracking the malware BaoLoader and their fraudulent code-signing certificates via AppSuite-PDF and PDF editor campaigns.
alt=
September 9, 2025  |  Ben Nahorney

Patch Tuesday: September 2025 (Expel’s version)

This month, we're highlighting top critical vulnerabilities, including an SAP S/4HANA code injection vulnerability currently being exploited.
You don’t find ManualFinder, ManualFinder finds you
August 22, 2025  |  Aaron Walton

You don’t find ManualFinder, ManualFinder finds you

We're investigating ManualFinder, a trojan malware we're seeing in new activity, likely coming from potentially unwanted programs (PUPs).
alt=
August 13, 2025  |  Ben Nahorney

Patch Tuesday: August 2025 (Expel’s version)

The August 2025 edition of Patch Tuesday is live, and this month we're highlighting targeted SharePoint vulnerabilities.

Worth your time

Expel Annual Threat Report 2025 - Web Thumbnail
Annual Report

Annual Threat Report 2025

What we saw, what it means, and what you should do about it. A full picture of recent threat trends, written by experts.

Download the report
The history of AppSuite: the certs of the BaoLoader developer
Threat Research

The history of AppSuite

We're tracking BaoLoader's code-signing certificate abuse—26 certs over seven years. This is how they stayed under the radar while pushing malware disguised as PDF editors.

Read now
Observing Atlas Lion (part 1): Why take control when you can enroll?
Threat Research

Observing Atlas Lion

Atlas Lion doesn't bother with persistence exploits. They just enroll their own VM into your domain and walk through the front door like they own the place.

Read now