The most dangerous attacks of 2026 don't look like attacks. They look like a Teams message from someone in IT, a genuine Microsoft sign-in page, or a package pulled from a familiar repository.
That is the throughline of Ontinue's 1H 2026 Threat Intelligence Report, released yesterday by the Zurich-based MXDR provider's Advanced Threat Operations team. The headline finding: roughly 30% of monitored organizations saw at least one fake IT support impersonation attempt over Microsoft Teams in the first half of the year. The report's broader argument is that attackers are scaling not by building better malware, but by abusing the trust defenders already extend to their own tools.
"The majority of effective attacks today don't rely on sophisticated exploits. They rely on trust," said Balazs Greksza, Director of Advanced Threat Operations at Ontinue. "Whether it's an attacker impersonating IT support through Microsoft Teams, abusing legitimate authentication workflows, or hiding command-and-control infrastructure within trusted services, we're seeing cybercriminals focus on blending into everyday business activity."
Ontinue reviewed 393,433 external Teams contacts involving 42,240 outside organizations. About one in every 990 carried at least one sign of IT-support impersonation. (A "contact" is one employee paired with one external person, counted once no matter how many messages or calls follow. Ontinue is careful to note these are signs of impersonation, not confirmed attacks.)
The technique has a lineage. It began with Black Basta affiliates in mid-2024. Black Basta fragmented after its internal chat logs leaked in February 2025, yet Teams vishing kept going through 2026 under operators with no established connection to the original crew. The tradecraft outlived its creators, which is about as clear a sign of commoditization as you get.
[RELATED: 'Hi, This Is IT': Vishing Campaign Turns Microsoft Teams into Attack Surface]
The playbook is consistent regardless of who runs it: an external "helpdesk" user opens a chat or call, cites an urgent device or security problem, and talks the target into launching Quick Assist, installing a remote tool, or running a PowerShell command. Quick Assist remains the favorite because it ships with Windows and needs no admin rights, but Ontinue also saw AnyDesk, ScreenConnect, TeamViewer, and Level.io.
Two findings should change how detection teams write rules:
The disguise lives in the mailbox address, not the display name. Impersonation signs appeared in the address (think helpdesk@) at 7.5 per 10,000 contacts, versus 5.0 for display names, 1.4 for sender domains, and just 0.15 for lookalike characters like "micr0soft." Rules that only check display names are inspecting the weaker signal.
Email bombing is the tell. Several campaigns flooded a target's inbox with newsletter and subscription spam, then called offering to "fix" it. A sudden mail spike against one mailbox followed within minutes by an inbound external Teams call is, per Ontinue, the highest-fidelity signal available for this technique.
Scam calls ranged from 60 seconds to more than 30 minutes. The short ones, Ontinue argues, mostly represent failures: declined calls, suspicious users, conversations that never started. The successful compromises clustered around the 20-minute mark.
That inverts a common assumption. Attackers who win aren't running quick scripts; they're building rapport, handling objections, and walking a victim through remote access step by step. As the report puts it, users braced for a 30-second scam are poorly prepared for a 20-minute conversation with someone who sounds like a colleague.
The good news hidden in that number: the intervention window is longer than most teams assume.
One of these calls led Ontinue's Cyber Defense Center to TWINLOOT, a previously undocumented modular Python implant—no exploit, no attachment. An operator posing as IT support convinced a target to run a PowerShell command, which pulled down an archive containing a Python runtime and a compiled loader.
What makes TWINLOOT notable is that it carries the trust abuse logic into post-exploitation. Its command and control runs entirely inside Microsoft services: SharePoint Online file dead-drops via the Microsoft Graph API for tasking, and Microsoft Teams TURN relay infrastructure for interactive operator access. To most network monitoring, that traffic looks like Microsoft 365 doing its job.
"These attacks work because they leverage the same tools employees use every day," said Craig Jones, Chief Security Officer at Ontinue. "The most dangerous attacks increasingly look like normal business activity."
The identity chapter is where the report gets uncomfortable for Microsoft-centric shops.
Ontinue confirmed 10 device code phishing compromises across five customer tenants in May and June 2026. Device code flow is a legitimate OAuth mechanism (RFC 8628) built for smart TVs and printers. In these attacks, victims authenticated on genuine Microsoft pages, sometimes completing MFA, but the code they entered authorized an attacker's session. No password ever changed hands.
From there, operators replayed refresh tokens against the Microsoft Authentication Broker, obtained Primary Refresh Token material, and registered attacker-controlled devices for persistence. In one case, a single identity had multiple rogue devices registered against it. In a financial services case, the attacker moved from consent to sequential access of Microsoft Graph, Azure AD, and the Device Registration Service in two minutes. In some cases, no default Sentinel alert fired.
Then there are passkeys. Microsoft auto-enabled passkey profiles for tenants that hadn't configured them between April and late May 2026. Ontinue calls this one of the more consequential platform changes of the period, and warns that it cuts both ways: tenants that never set attestation mostly landed on the more permissive default, which allows synced passkeys. And as passkeys make direct session phishing harder, Ontinue expects pressure to move to the seams: legacy MFA fallbacks still accepted by Conditional Access, and helpdesk recovery paths like Temporary Access Pass issuance. That is the Scattered Spider playbook, aimed at a new target.
Passkeys are phishing resistant. The migration to them, the report notes, is not automatically attacker resistant.
Ontinue ran an automated detonation pipeline against suspected ClickFix infrastructure for 10 weeks, executing 10,818 deep scans in an instrumented browser. Two findings stand out:
EtherHiding has gone mainstream. 25.3% of malicious findings (1,568 domains) retrieved their payload via blockchain RPC calls, resolving to just six smart contracts. No domain to sinkhole, no server to seize, no host to send an abuse notice. The most-contacted endpoint was a free BNB Smart Chain testnet RPC (1,143 observations), which Ontinue assesses is deliberate cost avoidance. Defenders watching only mainnet traffic miss it entirely.
Delivery is disposable; staging is concentrated. 6,188 delivery domains resolved to just 158 payload hosts, a 39:1 ratio. The top 10 hosts handled about two-thirds of confirmed delivery. And the lure sites aren't fresh registrations: median domain age was 5.2 years, with only 13.5% registered in the prior 30 days. These are compromised legitimate businesses. Blocking them punishes victims and loses the race; blocking payload hosts does neither.
[RELATED: DNS Saw the Malware Surge Coming]
The economics explain the volume. Complete ClickFix kits sell on criminal forums for about $250 a month or $1,800 for a lifetime license, and Ontinue cites ESET data showing ClickFix detections up 108% between H2 2025 and H1 2026.
Detection content is lagging, too. Caret escaping appeared in 25.9% of captured commands, more than 20 times the rate of base64 -EncodedCommand (1.2%), which is what most rules are tuned for. The Program Compatibility Assistant launcher, pcalua.exe, showed up in 25.4% of commands and is absent from many LOLBin rule sets.
The report traces supply chain compromise from XZ Utils, where "Jia Tan" spent roughly three years earning commit rights, to the Shai-Hulud worm, which uses preinstall scripts and TruffleHog to harvest tokens and republish victims' own npm packages.
Then it turns to a July 2026 incident disclosed by the UK AI Security Institute (AISI) on August 4. During a cyber range evaluation run 122 times across seven frontier models, with internet access deliberately enabled and vendor cyber classifiers deliberately disabled, agents took 19 unsanctioned actions on the live internet across 10 runs. Per Ontinue's account, 17 came from Anthropic's Mythos 5 and two from OpenAI's GPT-5.6-Sol. One agent opened a malicious pull request against a real open source project, registered fake GitHub accounts to lobby the maintainer, edited its own comments when challenged, and planted a prompt injection aimed at other coding agents.
It failed because a maintainer read the diff. Ontinue's point is blunt: Jia Tan needed three years; the agent got through a crude version of the same plan in three days, and what stopped it was human attention, with no technical control underneath.
The vendor community reached a consistent verdict: awareness training is necessary but not sufficient, and verification has to become routine.
Mika Aalto, Co-Founder and CEO of Hoxhunt, argues that phishing has escaped the inbox: "Attackers now move between email, Microsoft Teams, Slack, text messages, phone calls, and remote-access tools, with each interaction making the next one feel more credible," he said. He urges teams to treat password resets, MFA changes, device enrollment, and privileged-access requests made during unsolicited support interactions as high-risk events, adding that "those signals need to be correlated rather than managed in separate queues."
Aviv Nahum, Co-Founder and CEO of Above Security, sees AI erasing the cues employees were trained to spot: "The security model therefore must shift from 'does this look real?' to 'can I independently verify that this person is who they claim to be?''," he said.
Jason Soroko, Senior Fellow at Sectigo, points at the help desk itself, which typically relies on "fragile knowledge-based authentication that skilled threat actors bypass effortlessly." His suggestion: move beyond training toward robust identity verification, perhaps including mandatory video verification and certificate-based authentication.
Shane Barney, CISO at Keeper Security, frames it as a zero-trust gap: collaboration platforms, identity providers, and third-party integrations "carry implicit trust that rarely gets the same scrutiny as administrative access or privileged accounts. That is the blind spot."
Louis Eichenbaum, Federal CTO at ColorTokens, puts the burden on organizations rather than users: "Repeated incidents suggest the problem is not simply that individuals have failed to recognize a scam. Organizations have not yet made strong identity verification sufficiently routine and frictionless."
Drawing on Ontinue's recommendations and the expert commentary above, here are actions steps:
Lock down external Teams access. Restrict federation and remote-support tools to business need, and alert on unexpected Quick Assist or RMM launches.
Rewrite impersonation rules to inspect the local part of the email address, not just the display name.
Correlate the email-bomb-then-call sequence. It's the cleanest signal this technique produces.
Train for the patient caller. Prepare employees for a friendly 20-minute conversation, not a 30-second script, and give them a known internal channel to verify any unsolicited "IT" contact.
Restrict device registration to managed, compliant devices, and monitor non-interactive sign-ins to the Microsoft Authentication Broker from unfamiliar infrastructure.
Own your passkey configuration. Default to device-bound passkeys with attestation and an explicit AAGUID allow list, then retire legacy MFA fallbacks once enrollment reaches roughly 90%.
Harden help desk recovery. Short-lived, one-time Temporary Access Passes, delivered through verified channels, with a logged reason for every issuance.
Block payload hosts, not lure sites, and extend monitoring to blockchain RPC traffic, including testnets.
Keep a human on the merge button, and treat issue text, PR descriptions, and release notes as hostile input to any AI agent that reads them.
The cost of attack is falling, and Ontinue's data show where the savings come from: attackers no longer need to break in when they can be invited. A helpdesk address, a legitimate Microsoft login page, a public blockchain, and 20 patient minutes on a Teams call add up to a full compromise with no exploit in sight.
Detection built to catch last year's malware won't catch this year's trust abuse. The organizations that come out ahead will be the ones that make verification as routine, and as frictionless, as the collaboration it protects.