Microsoft Teams Impersonation Attempts Rise Globally
Threat actors are using workplace tools to bypass security by posing as internal IT support.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you feel confident in your ability to verify the identity of someone requesting remote computer access?
Cybersecurity firm Ontinue reports that 30% of its monitored organizations faced Microsoft Teams impersonation attempts during the first half of 2026. Attackers are currently exploiting workplace tools to trick employees into granting unauthorized account access.
Why it matters
The tactic of impersonating internal IT support allows attackers to blend in with normal business traffic, successfully bypassing conventional security detection systems. This trend highlights a growing reliance on trusted communication platforms as primary vectors for credential compromise.
Researchers identified 10 confirmed device-code phishing compromises across five customer tenants between May and June 2026. Blockchain-based infrastructure supported more than 25% of the malicious ClickFix findings tracked during this period.
The players
Ontinue
A cybersecurity firm that specializes in managed detection and response services.
Black Basta
A sophisticated ransomware-as-a-service group responsible for widespread enterprise data extortion.
The details
Attackers pose as IT support staff within Microsoft Teams, often directing users to open Windows Quick Assist or execute specific PowerShell commands. By tricking employees into completing a spoofed Microsoft authentication process, the threat actors gain account access without ever needing a password. This technique, popularized by the Black Basta ransomware group, weaponizes legitimate administrative tools to conduct these high-confidence social engineering campaigns.
Timeline
2024: Black Basta ransomware group popularized these attack techniques.
First half 2026: 30% of monitored organizations experienced Teams impersonation attempts.
May to June 2026: 10 confirmed device-code phishing compromises occurred across five customer tenants.
October 21, 2026: Ontinue released the threat intelligence report.
The Tech Race
This report tracks the continued evolution of techniques popularized by the 2024 Black Basta ransomware operations. The shift toward abusing trusted workplace communication tools represents a persistent challenge for standard security detection stacks.
Employees should remain skeptical of any unsolicited IT support requests originating within internal chat platforms. IT departments should consider strictly limiting the use of tools like Windows Quick Assist and PowerShell commands for standard user-facing support workflows.
The takeaway
The rise of device-code phishing within trusted enterprise environments suggests that human-in-the-loop social engineering is outpacing traditional perimeter defense. Security teams should monitor internal chat logs for high volumes of external contact requests to detect early indicators of impersonation campaigns.
Further reading
For broader trends in enterprise defense, explore our Cybersecurity section.
Source note: This article includes information reported by THE Journal.
Live Poll
Do you feel confident in your ability to verify the identity of someone requesting remote computer access?
