InstallFix: Not the application you were looking for InstallFix is a new watering hole attack we're seeing, and it leverages Claude Code as the lure. Here's what you need to know.

Developers are prime targets for cybercriminals, and blindly pasting terminal commands is a massive security risk. Always verify the domain before copying installation instructions, and implement strict execution controls. Read our full breakdown (7/7): expel.com/blog/install...

Defense strategy 2, Lock down LoLBins: On Windows, use WDAC policies to restrict unexpected living-off-the-land binaries like mshta and PowerShell. On macOS, lean on EDR and MDM systems to monitor and control the execution of curl and osascript. 6/7

Defense strategy 1, Network & clipboard: Stop the attack early by configuring DNS filtering and Secure Web Gateways to block newly registered domains. Additionally, use browser extensions with clipboard protections to warn users before they paste suspicious code. 5/7

Cross-platform threat: InstallFix targets macOS too, leveraging common tools like curl and osascript. While macOS Tahoe 26.4 added copy/paste warnings, developers (the main targets of this lure) are accustomed to bypassing these prompts for standard tool installations. 4/7

The evasion tactic: Attackers are getting sneaky with polyglot files. One variant hides malicious HTML inside an MSIX bundle, then uses the Windows mshta utility to execute it. Traditional sandboxes try to open the MSIX normally and fail, successfully bypassing analysis. 3/7

The bait: The official way to install Claude Code is by copying a command into your terminal. Attackers are cloning Anthropic's documentation pages and swapping the legitimate code with malicious commands. We have spotted 46 unique clone pages in just one month. 2/7

Beware of what you copy and paste. In March 2026, a new watering hole attack called "InstallFix" accounted for 13% of all malware incidents we observed. The lure? Fake install pages for Claude Code. Here is how it works and how to defend your environment. 1/7

The malware targeted Windows, macOS, and Linux systems.

If your systems show signs of compromise, treat your npm tokens, AWS access keys, SSH private keys, and other stored credentials as compromised until you’ve confirmed otherwise.
3/3

Security alert: Axios npm supply chain attack The Axios npm package suffered a supply chain attack from March 30-31. The malicious packages are no longer active, but here's what you need to know.

The malicious packages are no longer active, but the window was long enough to warrant a thorough hunt to identify possible compromise.

Our team has written up what happened, the attack chain, and what to look for. expel.com/blog/securit...
2/3

The Axios npm package is a component of many popular applications. Its compromise in turn impacted a lot of systems and software that relied on it. The package was actively serving a remote access trojan to Windows, macOS, and Linux systems.
1/3

Iran cyber threats: What security teams need to know right now | Expel briefing | Expel What security teams need to know about Iran cyber threats. Expert insights on Iranian capabilities, TTPs, and defensive measures to implement today.

Iran's cyber capabilities — ransomware, data wipers, stated intent to target Western infrastructure — aren't theoretical.

Expel's James Shank and Iran intel expert Steph Shample give security teams the straight picture: what's real, what it means, and what to do about it.
expel.com/resource/ira...

IT Admins - Manage external meetings and chat with people and organizations using Microsoft identities - Microsoft Teams For IT admins - Learn how to configure chat and meetings with people outside your organization who use Microsoft Entra ID, Microsoft Teams Essentials, or Skype.

The following is guidance from Microsoft to disable external senders:
learn.microsoft.com/en-us/micros...

When disabled, your organization will need to whitelist which external organizations can send unsolicited messages. This is a much safer configuration.

5/5

We’ve built out our detections around this activity, but orgs still need to tighten their own controls. The attack tactic has been around for years now: actors send a Teams message, request access via QuickAssist, and then create additional backdoors to the network.

4/5

Even more senders:

RyanMorris@seqhelpitsuppnetops[.]onmicrosoft[.]com
KevinMoore@secscanappsecopscenter[.]onmicrosoft[.]com
ThomasCarter@seqapsitsupportops[.]onmicrosoft[.]com
RachelMorgan@ioseccloudsupport[.]onmicrosoft[.]com

3/5

More malicious senders:

corporate[@]itelectronicshelpdesk[.]onmicrosoft[.]com
HelpDesk[@]officeactions[.]onmicrosoft[.]com
it_assistance[@]teams0138[.]onmicrosoft[.]com
IT_Assistance@teams0144[.]onmicrosoft[.]com
Support@StServiceIT[.]onmicrosoft[.]com

2/5

We continue to see high volumes of targeted phishing via Microsoft Teams.
The following are malicious senders just from this past week:

Corporat[@]HelpDeskFoundation[.]onmicrosoft[.]com
service[@]helpdeskfoundation[.]onmicrosoft[.]com
helpdesk[@]omkarcis[.]online

1/5

Security and finance leaders think they're aligned. Our new research with 300 of them says otherwise.

54% of finance leaders need strategic alignment metrics. Security's giving them maturity metrics instead. The language barrier is real—and fixable. expel.com/blog/new-res...

New Expel AI upgrade: “Pop the hood” on our detection strategies Expel added new AI-generated descriptions to our detection rules, written in plain English, to improve transparency and understanding.

We just dropped a new AI upgrade 🫳

Now you get plain-English explanations for every detection rule. See exactly which rules are firing, how your coverage evolves, and what's actually protecting you. Transparency isn't a feature, it's how MDR should work. expel.com/blog/new-exp...

On the radar: Weeding out XMRig XMRig is a cryptocurrency miner considered less malicious than other threats, but it's still worth prioritizing.

We're seeing XMRig cryptominers popping up everywhere recently. Threat actors love them because they’re a simple way to make money, and they can go unnoticed.

Here's how to spot them and shut them down before threat actors start monetizing: expel.com/blog/on-the-...

Our cybersecurity predictions for 2026 Our experts and leaders are sharing their predictions for cybersecurity trends in 2026 to help you start strategizing.

Our security leaders made their (brutally honest) 2026 predictions. The one thing they agree on? AI isn’t going anywhere, and it’s bringing new capabilities and threats into the new year.

Read all of their unfiltered takes: expel.com/blog/cyberse...

Why building a 24x7 SOC is getting harder (and what actually works instead) The math on building an in-house SOC has changed, including the real costs, why retention is brutal, and what actually works.

Your analysts are drowning. You can't hire fast enough. And even if you could, the math doesn't work.

The economics of running a 24×7 SOC have changed. Use our free calculator that shows you what your team needs whether that's building, buying, or augmenting: expel.com/blog/buildin...

Stories from the SOC: The second coming of Shai Hulud A new variant of the Shai Hulud worm has been discovered, and we're sharing effective approaches to remediate the threat.

Since then, we’ve continued to see and field incidents involving compromised NPM packages.

Here's the approach we've developed to identify and stop Shai Hulud activity: expel.com/blog/the-sec...

In the SOC, you get used to the noise. But a couple weeks ago, a single string cut through the noise: SHA1HULUD. It felt like seeing a ghost.

We traced the activity to a public GitHub repository where the customer's private cloud keys and secrets were exposed for anyone to grab.

More SIEM flexibility: Expel MDR adds support for Panther Expel announces support for Panther's cloud-native SIEM as the latest in our long list of advanced integrations.

Expel MDR now supports Panther.

We integrate with your cloud-native SIEM, bringing our detections, 24x7 monitoring, and incident response to work alongside what you've already built.

Use the tools that work for you. We'll make them work harder. expel.com/blog/more-si...

⚠️ Attackers are buying Google Ads that appear when looking up how to troubleshoot your Mac. The ad takes you to a shared ChatGPT chat that tells you to copy-paste some code. You've just executed malware.

Kroll has a solid write-up on the mechanics: www.kroll.com/en/publicati...

Expel Quarterly Threat Report, Q3 2025: Threat intel recap Here's a refresher on the threat intel we shared throughout the third quarter of 2025. Catch up on what you missed.

What actually works: strict application control policies and sanctioned tools. If users need productivity apps, give them approved options—or they'll find their own.

Full threat intel recap here: expel.com/blog/expel-q...

AI is making this worse. LLMs let criminals create convincing decoy applications faster than ever. The line between malware and PUPs is blurring, and it's not coming back.

We tracked BaoLoader through code-signing certificates across dozens of companies in the US, Panama, and Malaysia. It made up 13% of all commodity malware we identified this quarter. TamperedChef had 34,000+ downloads.

Part two of our QTR, Q3 2025 just dropped: malware disguised as apps that actually work.

BaoLoader hides backdoors in PDF editors and browsers. TamperedChef is a recipe app with hidden command codes. These apps function as promised, which is why users don't suspect anything.

Ransomware gang runs ads for Microsoft Teams to pwn victims : You click and think you're getting a download page, but get malware instead

Imagine searching for Microsoft Teams, visiting the link at the top of the results, & getting hit with malware. That's the malvertising campaign that the Rhysida ransomware gang has been running.

Expel Intel is tracking this campaign. Here's what we've uncovered: www.theregister.com/2025/10/31/r...