Loading story…
Attackers are increasingly abusing trusted enterprise collaboration platforms including Microsoft Teams, Slack, and Google Meet to steal credentials, impersonate employees, deliver malware, and maintain post-compromise access. Palo Alto Networks Unit 42 reported that alerts tied to malicious activity on collaboration tools increased more than fourfold over the past year, with 99% of those alerts linked to chat-based phishing. The activity reflects a shift from obviously malicious infrastructure to legitimate communication channels that users and defenders often trust by default.
Documented cases include APT29 phishing through Microsoft Teams, adversary-in-the-middle credential theft using attacker-controlled Slack workspaces, the Contagious Interview campaign themed around Fireblocks, the compromise of an Axios npm maintainer, Slack phishing reported by OpenSSF against Linux Foundation communities, and CERT Polska findings on Slack webhook abuse for persistence and credential exfiltration. Researchers said collaboration platforms now form part of the enterprise identity attack surface and urged organizations to tighten guest and federation controls, enforce stronger identity protections, verify sensitive requests through secondary channels, and correlate collaboration, endpoint, and network telemetry in monitoring and incident response.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
In April 2026, OpenSSF reported a campaign targeting members of the Linux Foundation TODO Group Slack workspace and related communities. The actor impersonated a known community leader, sent Slack DMs linking to Google Sites, walked victims through a fraudulent Google Workspace authentication flow, and on macOS also downloaded and executed a binary that could provide system access.
In March 2026, a threat actor used a staged Slack workspace and a staged Teams meeting to socially engineer the lead maintainer of the Axios npm package into installing software that delivered a remote access Trojan. The actor then accessed the maintainer's npm account and published two poisoned Axios versions that caused downstream projects to retrieve and execute a malicious dependency.
In January 2026, Fireblocks disclosed a social engineering campaign impersonating its executives, recruiters, and hiring managers. Targets were moved from social media to Google Meet interviews and instructed to clone a GitHub repository and run npm install, which executed malicious code and downloaded malware.
CERT Polska investigated a December 2025 intrusion at a manufacturing company in Poland where compromised firewall-VPN appliances were modified with weekly scheduled tasks. The scripts retrieved a privileged password, disabled two-factor authentication for a privileged account, and used the appliance's native Slack notification capability to send results to a threat-actor-controlled Slack channel.
Unit 42 published research describing how attackers abuse enterprise collaboration platforms such as Microsoft Teams, Slack, and Google Meet for identity phishing, impersonation, credential theft, malware delivery, and persistence. The report said collaboration-tool-related malicious activity alerts had more than quadrupled over the prior 12 months and that 99% of related alerts were tied to chat phishing operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
blog.knowbe4.com
Open sourcemalware.news
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly using **Microsoft Teams** chats to impersonate IT staff or trusted business contacts, persuading employees to approve MFA prompts, click malicious links, or hand over credentials. Palo Alto Networks Unit 42 said the tactic has appeared in multiple intrusions, including **Cloaked Ursa/APT29** activity that used compromised accounts to send malicious Teams messages and **UNC6692** operations that posed as helpdesk personnel to socially engineer targets through the platform. The report said phishing delivered through collaboration tools is rising quickly, with Cortex telemetry showing such activity accounted for **42% of all phishing alerts** in the first four months of 2026, up from **30%** in the prior four-month period. Attackers are exploiting permissive Teams federation settings, unmanaged external accounts, typosquatted domains, and compromised partner tenants to appear legitimate, prompting defenders to tighten external communication controls, restrict federation to approved domains, disable unmanaged external access where possible, strengthen identity protections such as Conditional Access and **Entra Privileged Identity Management**, and monitor for suspicious external chat initiation.
Jun 29, 2026
Multiple reports describe a broader **credential-theft trend** in which attackers abuse trusted services and familiar business workflows to make phishing more convincing and harder to detect. One campaign used **compromised WordPress sites** and redirects through `skimresources[.]com` to deliver pixel-perfect fake login pages for **Microsoft Teams**, **Xfinity**, and **UAE Pass**, with lures such as missed voicemail and shared-document alerts. Another campaign abused **LiveChat**'s `lc[.]chat` infrastructure to impersonate brands like **PayPal** and **Amazon**, moving victims into fake support conversations designed to extract sensitive information under the guise of refunds or order issues. A separate industry report reinforces the same operational pattern: attackers increasingly rely on **valid credentials** and trusted collaboration tools rather than software exploits, with cloud identity compromise driving most investigated incidents and some intrusions using **Microsoft Teams voice phishing** and **Quick Assist** to gain access, move laterally, and deploy ransomware. Other references in the set cover different stories entirely, including the **CamelClone** espionage operation, a **FancyBear/APT28** infrastructure exposure, and a general weekly security recap, and do not describe the same phishing activity. This is **not fluff** because the relevant items contain substantive threat intelligence on active attack methods, delivery infrastructure, and attacker tradecraft.
Jun 29, 2026
Threat actors are increasingly abusing workplace collaboration platforms, especially **Microsoft Teams**, to impersonate IT staff, vendors, and support personnel in social-engineering attacks that bypass user trust controls. Palo Alto Networks Unit 42 reported that collaboration-tool phishing accounted for **42%** of all phishing alerts seen in Cortex during the first four months of 2026, up from **30%** in the prior four-month period, showing a broader shift away from traditional email lures. The attacks commonly pressure users to approve multifactor authentication prompts or otherwise grant access, and researchers said both criminal and nation-state actors are using the technique. Cyfirma separately identified an active Teams-themed campaign that uses fake meeting transcript and recording notifications to lure victims to counterfeit landing pages hosted on compromised websites and attacker-controlled cloud infrastructure, including Cloudflare Workers and Pages. Victims are served a signed Windows installer that silently deploys a legitimate remote monitoring and management tool connected to attacker relay servers, then establishes persistence through a Windows service and registry changes, including mechanisms that survive Safe Mode with Networking. The intrusion chain also includes anti-analysis checks and credential theft via a credential provider DLL and an LSA authentication package, indicating the campaign is designed to convert a trusted collaboration message into durable unauthorized access.
Jun 29, 2026