Expel

https://expel.com/blog/

Managed-detection-and-response provider publishing first-hand incident analysis from its own SOC. Surfaced 2026-08-24 by the weekly run as the primary for SynkLoader, a previously unidentified Teams-delivered loader family that no other source in the list carried. FETCH -> feed https://expel.com/blog/rss.xml (verified direct, dated items with full links); AVOID https://expel.com/feed/ and https://expel.com/blog/feed/, both return non-XML. Candidate - promote to active after 3 contributing runs.