Expel’s quarterly threat intelligence report

Last quarter, we mentioned the upward trajectory of incidents where access was granted, and malicious activity occurred. This quarter we saw fewer incidents resulting in access but a greater proportion of them had harmful outcomes; this quarter, the increase is in access granted overall—meaning that less authentication attempts were blocked by existing security policies, although it’s unclear why.

Valid credential use broadly held steady across Q1, but a closer look points at a concerning shift. February stood out as the month where attackers gained the most ground. Combined access granted incidents, which includes those involving confirmed malicious activity, reached 50.4%, meaning more than half of incidents resulted in some level of access.

This level receded in March, which might appear to be an improvement, but the composition of that decline tells a more concerning story. The share of incidents where access was granted and malicious activity followed grew to 11%. In other words, while fewer incidents overall resulted in access in March, a greater proportion of those that did led to harmful outcomes.

The biggest shift over the last few quarters is the continued rise in targeted incidents. Prior to 2026, targeted incidents generally made up 1% or less of all incidents. However, in this quarter, 26.3% of incidents against endpoints were targeted.

For endpoints, malware remained the dominant threat in Q1 2026. At first glance, malware’s shrinking share as the quarter progressed might suggest a drop in activity. However, the opposite is true—overall endpoint incidents surged in March, with opportunistic attacks more than doubling from February. The volume of malware incidents grew as well. This is a meaningful distinction, because it means organizations weren’t facing less malware, they were simply facing even more of everything else on top of it.

Unauthorized access has hit a peak compared to past quarters, and supply chain has moved up since last quarter, but hasn’t surpassed all previous quarters—this pattern will likely stay the same as supply chain incidents seem to crop up on a more regular basis.

Unauthorized access and exposed cloud secrets were the two main methods used by attackers to gain entry to cloud infrastructure during the quarter. In March, supply chain attacks accounted for 10.7% of incidents, largely attributable to the Axios npm compromise that emerged toward the end of the month. A single third-party library incident accounting for a meaningful slice of an entire month’s cloud threats is a pointed example of how quickly supply chain events can translate into widespread exposure.

The malware landscape in Q1 was initially dominated by ClickFix and ChatGPT Stealer, which together accounted for a third of all malware incidents in January, and then almost half in February. March, however, brought a notable reshuffling. That top spot was claimed instead by InstallFix, a newly observed variant of the ClickFix technique, which accounted for 14.3% of March incidents.

Expel’s quarterly threat report is a threat intelligence resource published four times per year, based on real incident data handled by Expel’s SOC. It covers the top attack surfaces—identity, endpoint, malware, and cloud infrastructure—with breakdowns by incident type, attacker technique, and delivery method. Unlike a static annual report, the page retains historical data each quarter so readers can track how attacker behavior changes over time.

All data comes from real incidents investigated and remediated by Expel’s SOC across customer environments. It reflects attacker activity observed across identity, endpoint, malware, and cloud infrastructure, and is updated quarterly.

The quarterly threat report is updated four times per year and lives as a single page with rolling data, allowing readers to compare trends across quarters. The annual threat report is a comprehensive, point-in-time analysis published once per year with broader findings and forward-looking predictions.

According to Expel’s SOC data, identity-based incidents remained the top attack surface in Q2 2026, accounting for 68.1% of all incidents—up from 58.7% in Q1. Endpoint incidents declined to 29.8% of the total, while cloud infrastructure incidents held steady at 2.1%. The quarter’s biggest driver was a sharp rise in targeted endpoint attacks, climbing from the mid-teens in April and May to 38.4% in June, almost entirely attributable to Microsoft Teams-based phishing.

Microsoft Teams phishing continues to be one of the most persistent threats Expel’s SOC observes. It exploits a default Teams setting that allows external organizations to message internal users. Attackers typically impersonate IT support, prompting victims to install remote access tools. In Q2 2026, targeted endpoint attacks increased month-over-month, underscoring how organized and sustained this tactic has become.

In Q2 2026, 51.3% of identity incidents investigated by Expel’s SOC resulted in access being denied, 40.4% resulted in access granted without confirmed malicious activity, and 8.3% resulted in access granted with malicious activity detected. Both May and June saw access-granted rates climb above 50%, with malicious activity also increasing month over month; a shift from Q1, when overall access rates fell but a greater share of successful logins led to real harm.

Unauthorized access (48.4%) and exposed cloud secrets (29%) remained the top two cloud infrastructure threats Expel’s SOC tracked in Q2 2026. Supply chain incidents also spiked in May, driven largely by Mini Shai Hulud, a newly identified worm targeting the npm and PyPI ecosystems, echoing a similar spike from the Axios npm compromise in March. Supply chain attacks now appear to be a recurring risk for cloud environments rather than an isolated event.