The modern corporate landscape is undergoing a significant shift in threat vectors as cybercriminals move away from traditional, easily detectable malware toward the exploitation of legitimate, trusted workplace applications. According to the latest threat intelligence report from Ontinue, which analyzed security data from the first half of 2026, the primary battleground for enterprise security has migrated from email inboxes to collaborative platforms like Microsoft Teams. By weaponizing the tools that employees rely on daily, adversaries are achieving unprecedented success in bypassing standard security perimeters, forcing a fundamental rethink of corporate cybersecurity strategies.
The Rise of Collaboration-Based Social Engineering
During the first six months of 2026, approximately 30% of organizations monitored by Ontinue reported at least one attempt to impersonate internal IT support staff via Microsoft Teams. The scale of this phenomenon is significant; data suggests that one in every 990 external Teams contacts—those originating from outside the organization’s verified tenant—displayed clear indicators of an impersonation attempt.
Unlike traditional phishing campaigns that rely on malicious links or malicious attachments, these attacks are built on the foundation of trust. By masquerading as colleagues or support technicians, attackers can manipulate employees into performing actions that compromise their own workstations. This method has proven highly effective because it mimics the rhythm of standard workday communication. When an employee receives a message from someone appearing to be an IT administrator, the cognitive dissonance required to verify that request is often mitigated by the urgency of the situation presented by the attacker.
Anatomy of an Impersonation Attack
The methodology behind these attacks is deceptively simple, yet highly destructive. The process typically begins with an unsolicited Teams message or voice call from an individual claiming to be a member of the IT department. To create a sense of urgency, the attacker often cites a fabricated security vulnerability, an impending system crash, or a mandatory software update that requires immediate intervention.
Once the attacker has established a rapport, they guide the victim through a series of "remediation" steps. These often include:
- Utilizing Windows Quick Assist: Legitimate remote support tools that grant the attacker full control over the employee’s desktop.
- Executing PowerShell Commands: Commands designed to bypass local security controls or exfiltrate sensitive configuration data.
- Installing Remote Access Software: Persistent backdoors that allow the attacker to return to the machine even after the initial interaction has concluded.
This tactic gained notoriety through the actions of the Black Basta ransomware group in 2024, who effectively demonstrated the profitability of "IT impersonation" as a primary entry point. Since then, the technique has proliferated, with Ontinue identifying various threat actors—some with no discernible links to the original Black Basta campaigns—adopting and refining these social engineering strategies.
Beyond Teams: Authentication and Infrastructure Manipulation
While Teams-based impersonation is a primary focus, it represents only one facet of a multi-pronged assault on modern enterprise infrastructure. Researchers have also observed an alarming increase in the abuse of legitimate Microsoft sign-in processes. Between May and June 2026 alone, security teams identified 10 confirmed "device-code phishing" compromises across five customer environments.
In these instances, attackers leverage the legitimate OAuth device-code flow, which is intended to help users sign into applications on devices that lack a traditional browser. By tricking a user into authorizing a device code, the attacker gains access to the user’s session without ever needing to steal a password or bypass multi-factor authentication (MFA).
Furthermore, the technological infrastructure supporting these attacks is evolving. Ontinue’s report highlights that over 25% of confirmed malicious "ClickFix" findings—where users are tricked into clicking prompts that execute malicious scripts—are now hosted on blockchain-based infrastructure. This decentralized approach makes it significantly harder for security providers to take down malicious domains, as there is no central authority to serve a takedown notice to.
The Converging Threat Landscape
The sophistication of these attacks is compounded by the tactical blending of old and new methods. Some attackers have adopted a "flood and fix" strategy: they begin by inundating an employee’s inbox with unwanted, distracting emails—a deliberate "noise" campaign. Once the employee is sufficiently overwhelmed, the attacker initiates a Teams call, presenting themselves as the IT professional who can resolve the email flooding issue. This creates a psychological trap where the attacker is viewed as a savior, drastically reducing the victim’s skepticism.
Mika Aalto, co-founder and CEO of Hoxhunt, emphasizes the gravity of this shift: "Phishing no longer resides solely in your inbox. It has spread across the entire corporate communications environment." This realization necessitates a move away from legacy email security gateways as the sole defense mechanism.
The Role of Artificial Intelligence in Threat Evolution
The integration of artificial intelligence into the attacker’s toolkit has further blurred the lines between genuine communication and malicious impersonation. Aviv Nahum, CEO of Above Security, points out that AI is currently being used to synthesize familiar voices, mimic specific corporate writing styles, and facilitate fluid, real-time conversations.
When an attacker can sound exactly like a known coworker or IT professional, the traditional security model—which asks employees to judge whether a request "looks real"—becomes obsolete. As Nahum noted, "The security model therefore must shift from ‘does this look real?’ to ‘can I independently verify that this person is who they claim to be?’" This transition requires a cultural shift in how organizations handle internal verification, moving toward zero-trust principles where identity is never assumed, even within the corporate perimeter.
Strategic Recommendations for Enterprise Security
To mitigate these evolving threats, cybersecurity experts suggest a multi-layered defensive strategy that addresses both technical and human vulnerabilities:
- Enhanced Monitoring of Collaboration Platforms: Security operations centers (SOCs) must prioritize the monitoring of external Teams messages, specifically looking for abnormal volumes of requests from non-company accounts.
- Stricter Controls on Remote Access: Organizations should limit the use of tools like Windows Quick Assist to only authorized, pre-approved personnel and implement "just-in-time" access models that prevent unauthorized remote execution.
- Strict Authentication Hygiene: Companies should audit their OAuth permissions and device-code authorization settings to ensure that users are not inadvertently granting permissions to third-party applications.
- Verification Protocols: Employees should be trained to ignore urgent requests for technical support delivered via chat and instead verify such requests through secondary, established channels, such as a company’s internal ticketing system or a known, verified phone number.
- Behavioral Analytics: Implementing tools that detect suspicious PowerShell execution or abnormal authentication patterns can help security teams identify a compromise before the attacker can escalate their access.
Implications and Future Outlook
The findings presented in the 2026 threat intelligence report illustrate a grim reality: the perimeter has effectively dissolved. As Shane Barney, CISO of Keeper Security, succinctly stated, "Attackers are no longer looking for gaps in your perimeter. They are looking for the systems your organization already trusts and finding ways to move through them undetected."
The implications of this shift are profound. If the tools used to foster productivity—Teams, Slack, Zoom, and cloud-based authentication—are also the primary vectors for compromise, then the very act of working has become a potential security liability. Moving forward, the effectiveness of an enterprise’s security posture will not be measured by the strength of its firewalls, but by its ability to authenticate the legitimacy of its own internal communications.
Organizations must prepare for a future where identity verification is the final line of defense. As the barrier to entry for these sophisticated social engineering attacks continues to drop due to AI, the focus of the cybersecurity industry must pivot toward verifying the human element of the digital workspace. Until that happens, the trust-based nature of the modern enterprise will continue to be its greatest weakness.
