A method for identifying potential enterprise cyber threats camouflaged as legitimate software packages, the method comprising: performing, by a processing device: identifying visual and non-visual elements of a software package being presented for an action on an endpoint device within an enterprise, the visual element comprising an icon image; determining that the icon image is substantially similar to a reference image by performing a comparison of the icon image and the reference image; extracting the non-visual elements from the software package, wherein the extracted non-visual elements include authentication credentials of the software package; determining whether the authentication credentials of the software package match authentication credentials of an entity associated with the reference image determined to be substantially similar to the icon image; determining what proportion of software associated with the entity is signed by the entity; and determining whether the software package comprises a legitimate software package or a potential threat to the enterprise based, at least in part, on the determination of whether the authentication credentials of the software package match the authentication credentials of the entity associated with the reference image, and on the proportion of software signed by the entity. performing, by a processing device: identifying visual and non-visual elements of a software package being presented for an action on an endpoint device within an enterprise, the visual element comprising an icon image; determining that the icon image is substantially similar to a reference image by performing a comparison of the icon image and the reference image; extracting the non-visual elements from the software package, wherein the extracted non-visual elements include authentication credentials of the software package; determining whether the authentication credentials of the software package match authentication credentials of an entity associated with the reference image determined to be substantially similar to the icon image; determining what proportion of software associated with the entity is signed by the entity; and determining whether the software package comprises a legitimate software package or a potential threat to the enterprise based, at least in part, on the determination of whether the authentication credentials of the software package match the authentication credentials of the entity associated with the reference image, and on the proportion of software signed by the entity. identifying visual and non-visual elements of a software package being presented for an action on an endpoint device within an enterprise, the visual element comprising an icon image; determining that the icon image is substantially similar to a reference image by performing a comparison of the icon image and the reference image; extracting the non-visual elements from the software package, wherein the extracted non-visual elements include authentication credentials of the software package; determining whether the authentication credentials of the software package match authentication credentials of an entity associated with the reference image determined to be substantially similar to the icon image; determining what proportion of software associated with the entity is signed by the entity; and determining whether the software package comprises a legitimate software package or a potential threat to the enterprise based, at least in part, on the determination of whether the authentication credentials of the software package match the authentication credentials of the entity associated with the reference image, and on the proportion of software signed by the entity.