Modern cybersecurity threats have evolved far beyond the traditional paradigm of external actors battering at firewall perimeters. According to the latest threat intelligence report released by cybersecurity firm Ontinue, malicious actors are increasingly pivoting toward weaponizing legitimate, trusted workplace applications to infiltrate enterprise networks. Rather than expending energy on sophisticated zero-day exploits or complex malware development, contemporary cybercriminals are successfully leveraging human psychology, social engineering, and the very software tools employees rely on for daily collaboration.
The findings underscore a fundamental shift in the threat landscape. Enterprise defense strategies that historically concentrated on fortifying network perimeters and blocking malicious binaries at email gateways are finding themselves inadequate against attacks that blend seamlessly into normal business operations. As organizations embrace hybrid work models and cloud-based productivity suites, threat actors are aggressively following them into these environments, turning everyday communication platforms into vectors for compromise.
The Anatomy of Microsoft Teams Impersonation
A central finding of Ontinue’s research highlights the widespread abuse of Microsoft Teams for social engineering campaigns. During the first half of 2026, approximately 30 percent of organizations monitored by Ontinue encountered at least one incident where external actors attempted to impersonate internal IT support staff via Teams. Statistical analysis embedded within the report reveals that roughly one in every 990 external contacts on the platform exhibited indicators of an unauthorized individual posing as an enterprise IT technician.
These operations typically commence with an unexpected message or voice call originating from an account styled to resemble the organization’s internal help desk. The imposter alerts the target employee to an urgent, fabricated security vulnerability, an impending software crash, or a mandatory system update that requires immediate intervention. Under the guise of providing technical assistance, the attacker guides the victim through a series of actions designed to yield administrative access.
Victims are frequently instructed to open built-in utility programs such as Windows Quick Assist, install third-party remote-access applications, or execute specific PowerShell commands. Once these measures are enacted, the perpetrator gains quiet, persistent control over the workstation, frequently bypassing standard detection mechanisms because the initial interaction occurred within an approved, encrypted corporate communication channel.
This methodology bears a striking resemblance to techniques popularized by the notorious Black Basta ransomware syndicate in 2024. While Black Basta initially utilized telephone-based social engineering coupled with remote-monitoring tools to breach networks, Ontinue’s data indicates that the technique has metastasized across the broader cybercriminal ecosystem. Today, threat groups with no established historical ties to Black Basta have adopted and refined the playbook, turning IT impersonation into a commodity attack vector.
Chronology and Evolution of Collaboration Tool Exploits
The weaponization of workplace collaboration tools did not happen overnight; it represents a calculated evolution in cybercrime tactics that has accelerated over the past several years.
In the early phases of enterprise cloud adoption, threat actors primarily relied on credential-harvesting pages delivered via traditional email phishing. However, as organizations deployed advanced email filtering, automated threat intelligence, and mandatory multi-factor authentication (MFA), the return on investment for standard email phishing declined significantly.
By 2023 and 2024, criminal syndicates recognized that enterprise adoption of platforms like Microsoft Teams, Slack, and Zoom had created a false sense of security among end-users. Because these platforms are designed to facilitate frictionless internal collaboration, employees naturally exhibit lower levels of suspicion when receiving direct messages from individuals bearing internal organizational titles or department logos. Threat actors began registering external tenant accounts with deceptive display names—such as "IT Helpdesk Global" or "Security Operations Center"—and systematically querying directory lists to target corporate employees.
By 2025, security researchers observed an uptick in multi-stage campaigns where email phishing was combined with real-time collaboration app messaging. In these hybrid attacks, criminals would flood an employee’s inbox with automated noise or calendar spam to induce fatigue and confusion, immediately followed by a Teams message from a purported support agent offering to resolve the user’s sudden digital disruption.
By the first half of 2026, as documented in the Ontinue report, this tactic had matured into a systemic operational model affecting nearly a third of monitored enterprises, proving that collaboration tools had effectively become the new email inbox for phishing campaigns.
Expanding Threat Vectors: Device-Code Phishing and Blockchain Infrastructure
Beyond direct impersonation on communication channels, the Ontinue research highlights a diversification of techniques aimed at subverting legitimate authentication and infrastructure protocols.
Between May and June of 2026, researchers identified 10 confirmed device-code phishing compromises spanning five distinct customer tenants. Device-code authentication is a legitimate Microsoft feature designed to allow users to sign into applications on input-constrained devices, such as smart TVs or IoT hardware, by visiting a verification URL on a secondary device and entering a short code.
Cybercriminals have weaponized this process by tricking employees into executing a normal-looking authentication sequence that links the attacker’s device to the victim’s corporate account. This method allows the perpetrator to achieve session hijacking and gain unauthorized system access without ever needing to guess, steal, or crack the user’s password, effectively rendering traditional credential protection mechanisms inert.
Compounding these challenges, threat actors are increasingly utilizing decentralized infrastructure to obscure their operations. Ontinue’s data reveals that blockchain-based infrastructure accounted for more than 25 percent of confirmed malicious "ClickFix" findings. ClickFix campaigns typically display fake error messages—such as a prompt claiming a browser update or a document viewer requires manual command-line intervention—and trick users into pasting malicious scripts into PowerShell. By anchoring parts of their command-and-control infrastructure on blockchain networks, attackers make it significantly more difficult for traditional security tools to blacklist or disrupt malicious domains, as decentralized ledgers lack a single point of failure or centralized administrative control.
Industry Perspectives and Expert Analysis
The blurring lines between legitimate administrative communication and malicious social engineering have elicited widespread commentary from across the cybersecurity sector. Industry leaders emphasize that the fundamental architecture of corporate trust is being systematically targeted.
"The majority of effective attacks today don’t rely on sophisticated exploits. They rely on trust," noted Balazs Greksza, director of Advanced Threat Operations at Ontinue, emphasizing that human psychology remains the most accessible vulnerability in the enterprise stack.
Mika Aalto, co-founder and CEO of Hoxhunt, underscored the spatial expansion of phishing methodologies. "Phishing no longer resides solely in your inbox. It has spread across the entire corporate communications environment," Aalto stated, pointing to the necessity of organization-wide behavioral training that encompasses all corporate channels rather than email alone.
This sentiment was echoed by Shane Barney, chief information security officer at Keeper Security, who highlighted the strategic shift in hacker objectives. "Attackers are no longer looking for gaps in your perimeter. They are looking for the systems your organization already trusts and finding ways to move through them undetected," Barney observed.
Furthermore, the integration of artificial intelligence into the cybercrime arsenal is compounding the difficulty of defense. Aviv Nahum, co-founder and CEO of Above Security, pointed out that generative AI technologies are being deployed by threat actors to synthesize convincing audio, replicate specific writing styles, and sustain realistic conversational contexts during live chat or voice impersonation attacks.
"The security model therefore must shift from ‘does this look real?’ to ‘can I independently verify that this person is who they claim to be?’" Nahum asserted.
Broader Implications and Recommended Defensive Postures
The implications of Ontinue’s findings extend far beyond immediate data breaches; they signal an urgent requirement for organizations to rethink their operational security models. When collaboration tools and authentication processes built for productivity are successfully turned against the enterprise, traditional perimeter defenses lose their efficacy.
Security analysts argue that mitigating these risks requires a multi-layered approach combining technical monitoring with procedural rigor. Specifically, IT and security operations teams are advised to enhance surveillance of several key indicators:
- Unexpected or anomalous external contacts attempting to initiate conversations via collaboration platforms.
- Unsolicited remote-support requests or instructions to deploy remote-access utilities.
- Unauthorized or suspicious PowerShell script executions and command-line activity.
- Sudden modifications or anomalies within user authentication and device-code registration settings.
On the procedural front, organizations must enforce strict out-of-band verification policies. Employees should be trained to verify sensitive IT requests, software updates, or credential resets through established, pre-approved internal channels—such as walking to a physical help desk or calling a verified internal extension—rather than relying solely on the display name or profile credentials presented within a digital application window.
As threat actors continue to refine their exploitation of trusted workplace tools, the ultimate defense remains an organizational culture characterized by healthy skepticism, rigorous verification protocols, and continuous adaptation to the shifting contours of digital trust.
