Modern corporate cybersecurity is facing a fundamental paradigm shift as malicious actors abandon traditional malware exploits in favor of manipulating trusted internal communication channels and legitimate administrative frameworks. According to the latest threat intelligence report released by cybersecurity firm Ontinue covering the first half of 2026, contemporary cybercriminals are systematically weaponizing the very applications employees rely on daily to maintain productivity, transforming routine workplace tools into conduits for enterprise-wide compromise.
The report highlights a troubling reality: roughly 30 percent of organizations monitored by Ontinue experienced at least one targeted attempt to impersonate internal IT support personnel via Microsoft Teams during the opening six months of 2026. Statistically, this translates to approximately one out of every 990 external Microsoft Teams contacts exhibiting behavioral red flags indicative of an imposter attempting to masquerade as an internal technical support worker. Because these intrusions seamlessly blend into the background noise of ordinary workday communications, they consistently bypass the traditional psychological defenses that employees deploy against blatantly malicious external threats.
The Anatomy of Modern Trust-Based Exploitation
Rather than expending resources on developing zero-day vulnerabilities or sophisticated technical exploits, modern threat actors are capitalizing on human psychology and organizational trust structures. Balazs Greksza, director of Advanced Threat Operations at Ontinue, emphasized this strategic pivot in the company’s official announcement, noting that the vast majority of highly effective attacks executed today rely fundamentally on trust rather than complex code.
A typical attack vector unfolds through a carefully orchestrated sequence of social engineering maneuvers. An unsuspecting employee receives an unsolicited direct message or audio call via Microsoft Teams from an individual aggressively projecting authority under the guise of the corporate IT department. The imposter manufactures an urgent crisis, citing an immediate security emergency, a critical software malfunction, or a mandatory system update that cannot be postponed without severe operational consequences.
Under the guise of resolving the fabricated crisis, the attacker guides the target through a series of seemingly benign technical steps. The employee is frequently instructed to open built-in administrative utilities such as Windows Quick Assist, install third-party remote-access software, or execute specific PowerShell commands directly within their terminal environment. Executing these authorized actions surreptitiously hands complete control of the workstation over to the malicious actor, often leaving the victim entirely unaware that their system has been compromised until it is far too late.
This insidious methodology bears a striking resemblance to the tactics popularized in 2024 by the notorious Black Basta ransomware syndicate. While Black Basta initially pioneered and popularized the weaponization of collaborative platforms for corporate infiltration, Ontinue’s recent intelligence indicates that this technique has transcended its origins. It has now been enthusiastically adopted by a wide array of distinct cybercriminal enterprises, many of which maintain no known operational or structural ties to the original Black Basta group.
The Evolution of Collaborative Phishing and Multi-Layered Tactics
The malicious exploitation of enterprise collaboration tools is merely one facet of a broader campaign targeting the modern digital workplace. Threat actors are increasingly deploying multi-layered attack chains that combine traditional spam floods with highly targeted social engineering. In some observed campaigns, criminals initiate an assault by inundating an employee’s corporate email inbox with a massive volume of unwanted or spam messages. Once the victim is sufficiently overwhelmed and distracted by the influx of digital noise, the attacker reaches out through Microsoft Teams, posing as an IT specialist offering to clean up the inbox and resolve the technical nuisance.
Mika Aalto, co-founder and CEO of cybersecurity training firm Hoxhunt, underscored the changing landscape of electronic deception, pointing out that phishing has effectively broken free from the confines of the corporate inbox. It has successfully permeated the entirety of the corporate communications ecosystem, necessitating a holistic defense strategy that accounts for every collaborative channel an organization utilizes.
Beyond Teams impersonation, Ontinue researchers identified sophisticated adversaries exploiting legitimate administrative sign-in workflows to achieve unauthorized access without ever needing to crack an employee’s password. Between May and June of 2026, researchers documented 10 confirmed device-code phishing compromises spread across five distinct customer tenants. In these sophisticated incidents, attackers trick employees into authorizing a standard Microsoft authentication sequence under false pretenses. By manipulating the device-code registration process, criminals successfully bind their own malicious hardware to the user’s corporate account, granting them persistent, privileged access to sensitive systems while leaving authentication credentials entirely unaltered.
Furthermore, the report sheds light on the infrastructure powering these modern campaigns. Threat actors are increasingly turning to blockchain-based infrastructure to obscure their command-and-control servers and evade traditional network detection mechanisms. Ontinue noted that blockchain-backed hosting accounted for more than 25 percent of all confirmed malicious ClickFix findings analyzed during the reporting period.
Industry Reactions and the Impact of Artificial Intelligence
The widespread adoption of trust-based exploitation has triggered urgent calls from industry leaders for a comprehensive overhaul of enterprise security models. Shane Barney, chief information security officer at Keeper Security, noted that the strategic calculus of the modern cyber adversary has fundamentally transformed. Attackers are no longer expending energy searching for technical vulnerabilities in corporate perimeter defenses; instead, they are actively mapping the systems and platforms that an organization already implicitly trusts, finding subtle pathways to move laterally through them completely undetected.
Compounding these challenges is the rapid advancement and proliferation of artificial intelligence. Aviv Nahum, co-founder and CEO of Above Security, observed that generative AI tools are actively lowering the barrier to entry for cybercriminals, enabling them to fabricate highly convincing communications. AI allows malicious actors to accurately mimic familiar human voices, organizational writing styles, and nuanced conversational cadences, making social engineering attacks exponentially harder to detect through intuition alone.
Consequently, Nahum argues that the traditional corporate security model must undergo a philosophical inversion. Organizations can no longer rely on the subjective evaluation of whether an interaction looks or feels authentic. Instead, the guiding security question must shift entirely: "Can I independently verify that this individual is precisely who they claim to be?"
Actionable Defense Strategies for Enterprise IT and Security Teams
Mitigating the risks posed by collaborative tool impersonation and trust-based attacks requires a dual-pronged approach encompassing rigorous technical monitoring and proactive organizational awareness. Ontinue’s security analysts recommend that enterprise IT and security operations centers heighten their vigilance regarding specific behavioral indicators. Security teams must closely monitor unexpected or anomalous Teams contacts originating from external tenants, unusual requests for remote-support sessions, suspicious PowerShell execution logs, and unauthorized modifications to user authentication settings.
On the organizational front, employees must be thoroughly trained to reject the apparent authenticity of a display name or profile picture. Instead, personnel must be mandated to confirm any sensitive or urgent IT requests through established, out-of-band internal communication channels—such as calling a verified internal helpdesk number or walking physically to an IT service desk—rather than relying on the digital credentials presented on their screens.
As enterprises continue to embrace hybrid work models and cloud-based collaboration platforms, the attack surface will inevitably remain tethered to human trust. Navigating this landscape successfully will require organizations to treat internal communication channels with the same level of cryptographic and procedural scrutiny traditionally reserved for external network perimeters. The full, comprehensive findings of the Ontinue threat intelligence report remain accessible via their official publication portal.
