Press play to start listening
Ontinue’s 1H 2026 threat report shows attackers increasingly abusing Microsoft Teams, npm packages, device-code logins and blockchain ClickFix tactics to steal access and spread malware.
Cybercriminals are increasingly abusing legitimate business tools to access organizations, steal credentials and spread malware, rather than relying only on software vulnerabilities, according to Ontinue’s 1H 2026 Threat Intelligence Report.
The report describes how these tactics are showing up across workplace communications, Microsoft authentication and software supply chains.
Fake IT Support on Microsoft Teams
Ontinue found that attackers continued impersonating IT support staff through Microsoft Teams during the first half of 2026. The approach involves contacting employees from outside their organizations and posing as colleagues or help-desk staff to convince them to take actions that give attackers access.
The company examined 393,433 external contacts across 42,240 outside organizations. About one in every 990 external contacts showed signs of IT-support impersonation. Around 30% of the organizations monitored by Ontinue had at least one such contact, although the figures do not confirm that a compromise occurred.
Black Basta affiliates used the technique in 2024. The group later fragmented after its internal chats leaked in February 2025, but other threat actors continued using similar tactics.
Shai-Hulud and the Software Supply Chain
The report examines Shai-Hulud, an npm worm that targets developer credentials to spread through the software supply chain. The worm runs during package installation, downloads the Bun JavaScript runtime and uses TruffleHog to search for exposed secrets.
It can then use stolen npm tokens to publish compromised packages, while malicious GitHub workflows and self-hosted runners help it continue spreading. The worm also publishes stolen credentials to public GitHub repositories, exposing them to further abuse.
Hackread.com previously reported a Shai-Hulud resurgence affecting more than 1,280 npm packages, including packages used across widely downloaded JavaScript projects.
Ontinue also cites controlled evaluations by the UK AI Security Institute in which AI agents exceeded their assigned testing scope. One agent submitted a malicious pull request and created fake GitHub accounts to promote it. The findings raise questions about how autonomous agents could be abused, but do not establish a successful real-world supply-chain breach.
Microsoft Authentication Under Attack
Between May and June 2026, Ontinue confirmed ten device-code phishing compromises across five customer tenants. The affected sectors were professional services, industrial automation, industrial equipment manufacturing, financial services and research.
In these attacks, victims entered authentication codes into Microsoft’s legitimate sign-in flow, allowing attackers to obtain refresh tokens. Researchers observed operators replaying tokens, obtaining Primary Refresh Token material and registering unauthorized devices to maintain access. Some cases had no corresponding default Microsoft Sentinel alert when discovered.
ClickFix Moves to Blockchain
Ontinue’s ten-week ClickFix analysis recorded 10,818 scans, of which 6,276, or 58%, were classified as malicious. Researchers identified 6,188 delivery domains linked to just 158 payload hosts, showing how a large pool of domains can funnel victims toward a much smaller set of malware servers.
The report also found that 1,568 malicious findings, or 25.3%, used EtherHiding to retrieve payloads through blockchain infrastructure. Six distinct smart-contract addresses were identified.
Experts’ Commentary
The findings highlight how attackers exploit trusted communication channels and authentication processes rather than relying solely on technical vulnerabilities. Several cybersecurity experts shared comments with Hackread.com, emphasizing that organizations need stronger identity verification and consistent monitoring of trusted systems.
Jason Soroko, Senior Fellow at Sectigo, said attackers exploit both trust in IT support workflows and the lack of cryptographic verification during human interactions.
“Help desks exist to assist employees facing access issues and typically rely on fragile knowledge-based authentication that skilled threat actors bypass effortlessly,” Soroko said. He called for stronger identity verification, including “mandatory video verification and certificate based authentication.”
Shane Barney, Chief Information Security Officer at Keeper Security, said attackers increasingly target systems organizations already trust rather than looking for weaknesses in traditional network perimeters.
“Collaboration platforms, identity providers, and third-party integrations all carry implicit trust that rarely gets the same scrutiny as administrative access or privileged accounts. That is the blind spot,” Barney said. He urged organizations to apply zero-trust principles consistently, validating every session, monitoring access paths and flagging unusual behavior, even when activity comes through trusted tools.
Kern Smith, Vice President of Global Solutions at Zimperium, warned that phishing campaigns have evolved to target authentication processes, particularly on mobile devices.
“Phishing has evolved into real-time, interactive deception designed to defeat MFA, especially on mobile devices,” Smith said. He added that defenses should combine strong identity platforms with on-device mobile threat detection to prevent credentials and sessions from being exposed.
