#Cybersecurity #Switzerland #Zurich #Ontinue #Microsoft Teams

Introduction

Recent findings from Ontinue's 1H 2026 Threat Intelligence Report highlight a significant rise in cyberattacks targeting organizations through impersonation scams on platforms like Microsoft Teams. Nearly 30% of monitored entities reported experiencing at least one fake IT support impersonation attempt over the past six months.

The Rise of Impersonation Scams

As cybercriminals evolve their tactics, attackers are increasingly taking advantage of trusted identities and popular collaboration platforms to exploit organizational workflows. The report, backed by extensive threat intelligence research, details how rather than relying on complex malware, many attackers now focus on leveraging existing trust to execute their schemes. By blending into everyday business activities, they evade detection far more effectively.

According to Balazs Greksza, the Director of Advanced Threat Operations at Ontinue, “The majority of effective attacks today don't rely on sophisticated exploits. They rely on trust.” This fundamental shift in strategy means that organizations must bolster their defenses against trusting attacks, particularly as everyday tools are manipulated to serve malicious ends.

Key Findings of the Report

1. Microsoft Teams as a Target: Approximately 30% of organizations experienced attempts where attackers impersonated IT support using Microsoft Teams.
2. Widespread Impersonation: Roughly one in every 990 external contacts in Teams exhibited signs of impersonation, making the collaboration tool a frequent pathway for attacks.
3. Adapted Attack Methods: The report highlights a disturbing trend where attackers utilize legitimate Microsoft authentication workflows to compromise credentials, often without needing to steal passwords directly.
4. Device-Code Phishing Uptick: Ontinue identified 10 confirmed device-code phishing incidents across several customer accounts, showcasing the rising risks presented by new phishing techniques.
5. Blockchain Utilization: Attackers are also increasingly leveraging blockchain technology to host malicious content efficiently, revealing a new layer of sophistication in their tactics.

Implications for Organizations

The frequency and sophistication of these attacks underscore a pressing need for organizations to enhance their visibility and monitoring capabilities across identities and user behaviors. Craig Jones, the Chief Security Officer at Ontinue, emphasized, “Security teams need visibility across identities, collaboration platforms, and user behavior to identify threats before they become incidents.”

This call for action is supported by the report’s findings that highlight the importance of real-time monitoring and quick response capabilities in deterring such attacks. Organizations must remain vigilant and proactive, ensuring that their employees are well-informed about potential scams and how to recognize signs of impersonation.

Conclusion

As organizations become more reliant on digital collaboration tools, the potential threats they face will continue to evolve. Ontinue's report serves as a crucial reminder that cybersecurity is not just about technical defenses; it is also about building a culture of security awareness and trust within the organization. By understanding and mitigating the risks associated with impersonation scams, businesses can better protect themselves against the growing tide of cyber threats.