Attackers Exploit Teams, Slack, and Meet for Identity Phishing and Persistence

Attackers are increasingly abusing trusted enterprise collaboration platforms including Microsoft Teams, Slack, and Google Meet to steal credentials, impersonate employees, deliver malware, and maintain post-compromise access. Palo Alto Networks Unit 42 reported that alerts tied to malicious activity on collaboration tools increased more than fourfold over the past year, with 99% of those alerts linked to chat-based phishing. The activity reflects a shift from obviously malicious infrastructure to legitimate communication channels that users and defenders often trust by default.

Documented cases include APT29 phishing through Microsoft Teams, adversary-in-the-middle credential theft using attacker-controlled Slack workspaces, the Contagious Interview campaign themed around Fireblocks, the compromise of an Axios npm maintainer, Slack phishing reported by OpenSSF against Linux Foundation communities, and CERT Polska findings on Slack webhook abuse for persistence and credential exfiltration. Researchers said collaboration platforms now form part of the enterprise identity attack surface and urged organizations to tighten guest and federation controls, enforce stronger identity protections, verify sensitive requests through secondary channels, and correlate collaboration, endpoint, and network telemetry in monitoring and incident response.