Expel 2023 Q3 Quarterly Threat Report: the top five findings

Q3 2023 SOC findings: identity-based attacks dominated (71% of incidents) with AiTM session-cookie theft emerging as the most common vector for account takeover; QR-code phishing increased the challenge of detection on mobile devices; and DarkGate (commodity malware/RAT) proliferated via ads, email links, and collaboration tools, often facilitated by initial access brokers—resulting in numerous high-risk infections and pre-ransomware activity.