MS Teams Phishing, ClickFix and Shai-Hulud npm Attacks Dominate Threat Report
Ontinue’s 1H 2026 threat report shows attackers increasingly abusing Microsoft Teams, npm packages, device-code logins and blockchain ClickFix tactics to steal access and spread malware.
Cybercriminals are increasingly abusing legitimate business tools to access organizations, steal credentials and spread malware, rather than relying only on software vulnerabilities, according to Ontinue’s 1H 2026 Threat Intelligence Report.
The report describes how these tactics are showing up across workplace communications, Microsoft authentication and software supply chains.
Fake IT Support on Microsoft Teams
Ontinue found that attackers continued impersonating IT support staff through Microsoft Teams during the first half of 2026. The approach involves contacting employees from outside their organizations and posing as colleagues or help-desk staff to convince them to take actions that give attackers access.
The company examined 393,433 external contacts across 42,240 outside organizations. About one in every 990 external contacts showed signs of IT-support impersonation. Around 30% of the organizations...
Copyright of this story solely belongs to hackread.com. To see the full text click HERE
