Modern cybersecurity threats have evolved far beyond conventional malware payloads and isolated phishing emails, shifting toward a strategy of weaponizing the very applications that enterprises rely on for daily collaboration. According to a comprehensive threat intelligence report released by cybersecurity firm Ontinue, threat actors are systematically exploiting trusted workplace infrastructure—most notably Microsoft Teams and legitimate cloud authentication mechanisms—to infiltrate enterprise networks.
The report highlights a troubling operational trend: approximately 30 percent of organizations monitored by Ontinue experienced at least one targeted attempt by malicious actors impersonating internal IT support personnel via Microsoft Teams during the first half of 2026. Statistically, the scale of this campaign is significant, with roughly one out of every 990 external Microsoft Teams contacts exhibiting indicators of malicious actors masquerading as internal IT staff.
Rather than relying on resource-intensive, highly sophisticated zero-day exploits or breaking through robust network perimeters, modern cybercriminal syndicates are finding success by exploiting human psychology and organizational trust. This paradigm shift represents a fundamental transformation in how enterprises must view their security posture, moving away from perimeter defense toward a zero-trust verification model that accounts for internal collaboration channels.
Anatomy of a Modern Collaboration Tool Attack
The attack vectors identified in the Ontinue research are designed to blend seamlessly into the background noise of standard corporate communications. Because employees are conditioned to respond promptly to internal IT requests regarding security patches, software updates, or hardware troubleshooting, attackers leverage this compliance to bypass traditional skepticism.
A typical attack lifecycle begins with an unexpected communication delivered directly to an employee via Microsoft Teams, either through a chat message or a voice call. The threat actor, posing as a member of the corporate IT department, manufactures a sense of urgency by warning the target about an imminent security vulnerability, a critical software malfunction, or a mandatory system update that requires immediate remediation.
Once the victim is engaged, the fraudulent IT representative guides them through a sequence of seemingly benign technical steps. These instructions often involve opening built-in system tools like Windows Quick Assist, downloading and installing unauthorized remote-access software, or executing administrative commands via PowerShell. Without realizing that they are compromising their own security perimeter, the employee inadvertently grants the attacker remote administrative control over their workstation.
This technique bears striking operational similarities to methods popularized by the Black Basta ransomware group in 2024. While Black Basta initially pioneered and showcased the effectiveness of leveraging enterprise collaboration tools for social engineering, Ontinue’s latest intelligence indicates that the tactic has since been democratized. A wide array of independent cybercriminal groups—many with no verifiable ties to Black Basta—have incorporated Microsoft Teams impersonation into their standard playbooks.
Multi-Pronged Campaigns and Blended Tactics
Sophisticated threat actors are no longer relying on single-vector approaches; instead, they are orchestrating multi-stage campaigns that combine email-based noise with real-time chat manipulation. For example, researchers have documented scenarios where attackers first flood an employee’s corporate inbox with automated junk mail or simulated alert notifications to induce confusion and panic. Shortly thereafter, the threat actor reaches out via Microsoft Teams, presenting themselves as an IT specialist who has identified the email flood and is standing by to help resolve the technical issue.
This blending of communication channels creates a coherent, highly convincing narrative that disarms the target. Mika Aalto, co-founder and CEO of Hoxhunt, captured the evolution of this threat landscape, noting that phishing has effectively broken free of the inbox and saturated the entire corporate communications environment.
The diversification of attack vectors extends well beyond social engineering on chat platforms. Ontinue’s research team documented a notable rise in threat actors weaponizing legitimate Microsoft sign-in processes to hijack user accounts. Between May and June, security analysts identified 10 confirmed device-code phishing compromises spread across five distinct customer tenants. In these incidents, criminals trick employees into completing what appears to be a routine, legitimate Microsoft authentication sequence. Because the interaction leverages authentic system workflows, the attacker gains unauthorized access to the user’s account and associated systems without ever needing to crack or reset the victim’s password.
Furthermore, the report highlights the growing adoption of blockchain-based infrastructure by threat groups attempting to obscure their malicious activity. Over 25 percent of confirmed malicious ClickFix findings utilized decentralized blockchain networks to hide command-and-control operations and payload delivery mechanisms, complicating attribution and forensic analysis for corporate security teams.
Industry Perspectives and Expert Analysis
The cybersecurity community has responded to the Ontinue findings with widespread consensus: enterprise security architectures are facing a critical adaptation period. Shane Barney, chief information security officer at Keeper Security, emphasized the strategic shift in hacker methodology. Barney pointed out that modern adversaries are no longer hunting for vulnerabilities in traditional network perimeters; instead, they are actively cataloging the software, tools, and platforms that an organization already trusts, engineering methods to traverse those trusted channels undetected.
This reliance on trusted tools has transformed collaboration platforms into vectors for lateral movement. Security operations centers (SOCs) are now forced to monitor internal communications channels with the same level of scrutiny traditionally reserved for inbound internet traffic and email gateways. Experts recommend that IT and security teams implement heightened monitoring for anomalous indicators, such as unexpected external Teams contacts, sudden requests for remote-support sessions, suspicious PowerShell script executions, and unauthorized modifications to user authentication settings.
Compounding the difficulty of detecting these campaigns is the rapid advancement of artificial intelligence. Aviv Nahum, co-founder and CEO of Above Security, highlighted the role that generative AI and machine learning tools play in modern social engineering. Threat actors are increasingly utilizing AI models to flawlessly mimic familiar corporate writing styles, imitate specific individual voices, and sustain convincing conversational contexts over chat and voice channels.
As AI-driven impersonation becomes more accessible to cybercriminals, Nahum argues that the fundamental security paradigm must evolve. Organizations can no longer rely on subjective assessments of whether a communication "looks real." Instead, the operational standard must shift toward absolute cryptographic or procedural verification: the ability to independently confirm that an individual is precisely who they claim to be through out-of-band channels.
Implications for Enterprise Security Posture
The findings from the 2026 Ontinue threat intelligence report underscore an urgent need for organizational introspection regarding enterprise risk management and employee training. Security awareness training programs can no longer focus exclusively on identifying suspicious URLs in emails or avoiding generic phishing templates. Employees must be systematically educated on the risks associated with out-of-band requests received via collaboration software, and they must be empowered to independently verify sensitive instructions through established internal escalation pathways rather than trusting the display name or avatar of an incoming message.
Ultimately, the weaponization of workplace tools serves as a stark reminder that technology solutions designed to enhance productivity and streamline remote collaboration also introduce inherent human-layer vulnerabilities. As long as trust remains the path of least resistance for cybercriminals, organizations must adapt their defensive postures to treat internal collaboration platforms with the same rigorous skepticism historically applied to the open internet.
