Federal News
Expel Highlights Identity Compromise Risks
March 21, 2026
The 2026 Expel Annual Threat Report reveals that identity compromise remains the leading tactic used by threat actors, responsible for over 68% of cybersecurity incidents. The report specifically warns about unauthorized PDF editor software acting as trojans that establish persistent backdoors on endpoints, often leveraging encoded PowerShell to deploy additional malicious payloads. This underscores the critical importance of enforcing sanctioned software use and continuous employee cybersecurity training to mitigate these risks.
- Procurement professionals should prioritize cybersecurity solutions that address identity compromise and endpoint protection, especially those capable of detecting and mitigating trojanized software.
- Agencies and contractors must enforce strict software approval policies and invest in ongoing user awareness programs to reduce insider risk and unauthorized software use.
- Cybersecurity vendors offering advanced threat detection and response capabilities, particularly around endpoint security and identity protection, may find increased demand.
- Organizations should evaluate their current cybersecurity posture against these emerging threat vectors to inform procurement strategies and risk management plans.
these 7PDF editors8 are actually trojans, which use their safe-looking outer shell to establish a foothold on your endpoints. The malware maintains persistence, making sure that the software creates a service that runs on the endpoint, keeping the PDF editor running. We often see these editors then used as a backdoor to run malicious code on the host, commonly abusing encoded PowerShell to download a second payload.
— Expel
Vendors
Expel