Expel’s Q2 2026 threat report: Identity’s back on top, and Teams phishing isn’t slowing down

Expel’s Q2 2026 SOC report finds identity attacks rebounding to 68.1% of incidents, endpoint incidents overall declining but spiking in June due to Microsoft Teams phishing that delivers remote access tools with ransomware intent, and cloud incidents driven by misconfigurations, exposed secrets, and a newly observed npm/PyPI supply-chain worm called Mini Shai Hulud; the report indicates active exploitation and increasing attacker success against identities in May–June.