The findings, detailed in Ontinue’s 1H 2026 Threat Intelligence Report, highlight a shift toward exploiting human trust over technical vulnerabilities. Researchers observed that approximately one in every 990 external Teams contacts showed clear indicators of impersonation, with attackers posing as internal IT staff to trick employees into granting remote access or executing malicious commands. Balazs Greksza, Director of Advanced Threat Operations at Ontinue, noted that cybercriminals are prioritizing the ability to blend into everyday business activity, making identity protection and real-time visibility critical for modern enterprises.

Beyond collaboration platforms, the report reveals a rapid industrialization of attack infrastructure. Analysts examining over 10,800 ClickFix campaigns found that 25.3% of malicious activity now leverages blockchain technology for command-and-control operations, effectively masking payload delivery from domain-based filters. This trend is compounded by a high concentration of malicious activity, where 6,188 delivery domains were traced back to just 158 payload hosts. As credential harvesting and device-code phishing become more prevalent, industry experts are urging a transition toward phishing-resistant authentication methods to mitigate the risks posed by these evolving, trust-based exploits.