Cyber Attacks Increasingly Exploit Trusted Workplace Tools
A new threat intelligence report from Ontinue found that attackers are increasingly using trusted workplace tools to trick users into giving them access to enterprise networks. Approximately 30% of organizations monitored by the cybersecurity company experienced at least one attempt to impersonate IT support through Microsoft Teams during the first half of 2026. About one in every 990 external Teams contacts showed signs of someone pretending to be an internal IT worker.
Ontinue's report says the trouble is that these attacks blend in with ordinary workday communication, which makes them harder to catch.
"The majority of effective attacks today don't rely on sophisticated exploits. They rely on trust," Balazs Greksza, director of Advanced Threat Operations at Ontinue, said in the company's announcement.
Ontinue broke down how a typical attack works: An employee gets an unexpected Teams message or call from someone claiming to work in the organization's IT department. The person warns of a security issue, a software problem or an update that can't wait. Then they walk the employee through opening Windows Quick Assist, installing remote-access software, or running a PowerShell command. Following those steps can hand the attacker control of the employee's computer, often without the employee realizing it.
The approach is very similar to the Black Basta ransomware group, which helped popularize similar attacks in 2024. Unfortunately, Ontinue found the technique has since been adopted by other cybercriminal groups, including some with no known link to Black Basta.
Some threat agents are also combining tactics. They might first overwhelm an employee's inbox with unwanted e-mails, then reach out through Teams pretending to be IT support offering to fix the problem.
"Phishing no longer resides solely in your inbox. It has spread across the entire corporate communications environment," said Mika Aalto, co-founder and CEO of Hoxhunt.
Teams impersonation is only part of the problem. Ontinue also found attackers taking advantage of legitimate Microsoft sign-in processes. Between May and June, researchers identified 10 confirmed device-code phishing compromises across five customer tenants.
In these attacks, criminals trick employees into completing what appears to be a normal Microsoft authentication process. But doing so can give the attacker access to the employee's account and system without actually breaking their password.
The report also found attackers using blockchain-based infrastructure to hide malicious activity, accounting for more than 25% of confirmed malicious ClickFix findings.
"Attackers are no longer looking for gaps in your perimeter. They are looking for the systems your organization already trusts and finding ways to move through them undetected," said Shane Barney, chief information security officer at Keeper Security.
The security firm says that IT needs to keep a closer eye on unexpected Teams contacts, remote-support requests, suspicious PowerShell activity, and changes to authentication settings. Employees should also confirm sensitive requests through established internal channels, rather than relying on the name or account that appears on their screen.
Aviv Nahum, co-founder and CEO of Above Security, noted that AI is making these attacks more convincing by helping criminals imitate familiar voices, writing styles, and conversations.
"The security model therefore must shift from 'does this look real?' to 'can I independently verify that this person is who they claim to be?'" Nahum said.
The full Ontinue report is available here.