Microsoft Teams Fake IT Support Scams Target 30% of Organizations in…

Event summary

Ontinue's 1H 2026 Threat Intelligence Report found 30% of monitored organizations experienced fake IT support impersonation attempts via Microsoft Teams.
Attackers increasingly abuse trusted identities, collaboration platforms, and business workflows to scale operations with lower effort.
10 confirmed device-code phishing compromises were identified across five customer tenants between May and June 2026.
25.3% of confirmed ClickFix campaigns leveraged blockchain-based command-and-control infrastructure.
6,188 delivery domains resolved to just 158 payload hosts, indicating industrialization of attacker infrastructure.

The big picture

Ontinue's report highlights a shift in cybercriminal tactics from sophisticated malware to exploiting trust in legitimate platforms and workflows. This trend underscores the growing importance of identity protection and rapid response capabilities in enterprise security strategies. The abuse of Microsoft Teams and other collaboration tools signals a broader industry challenge in securing digital workspaces against social engineering attacks.

What we're watching

Identity Protection: How organizations will adapt passkeys and phishing-resistant authentication to counter credential-based attacks.
Collaboration Security: Whether security teams can improve visibility across identities, collaboration platforms, and user behavior to preempt threats.
Attacker Infrastructure: The pace at which attackers will continue to industrialize and conceal malicious infrastructure using blockchain technology.