Expel-Annual-Threat-Report-2026.md

Expel’s 2026 Annual Threat Report analyzes nearly a million alerts from 2025 and finds identity-based attacks dominated incidents (68.6%), followed by endpoint malware (29%) and smaller but high-impact cloud incidents (2.5%); notable findings include widespread credential theft and MFA bypass via PhaaS, prevalent infostealers (e.g., Vidar, StealC) and ClickFix-driven malware, a supply-chain worm (Shai Hulud 2.0) that harvests IAM secrets, and a critical server-side vulnerability (React2Shell), with recommendations to prioritize fundamentals like conditional access, FIDO2 MFA, application whitelisting, secret monitoring, and targeted detections.