Zurich – October 13, 2026 -- Approximately 30% of monitored organizations experienced at least one fake IT support impersonation attempt through Microsoft Teams in the first half of 2026, according to Ontinue's 1H 2026 Threat Intelligence Report. The managed detection and response (MXDR) provider says attackers are gaining scale by exploiting trusted identities, collaboration platforms, software supply chains and routine business workflows rather than by building more sophisticated malware.
The findings draw on incident investigations, threat intelligence research and telemetry from Ontinue's Advanced Threat Operations team.
Teams impersonation reaches roughly one in 990 external contacts
About one in every 990 external Teams contacts showed indicators of impersonation activity. Attackers pose as internal IT support to persuade employees to grant remote access or execute malicious actions, without exploiting a technical vulnerability. Ontinue's Chief Security Officer Craig Jones said security teams need visibility across identities, collaboration platforms and user behavior to catch such threats before they become incidents.
Device-code phishing compromises 10 tenant accounts across five customers
Ontinue confirmed 10 device-code phishing compromises across five customer tenants between May and June 2026. Attackers gained access through legitimate Microsoft authentication experiences without stealing a user's password. The report also documents token theft, credential harvesting and session hijacking, and notes the industry shift toward passkeys and phishing-resistant authentication.
Blockchain hosts 25.3% of confirmed malicious ClickFix command-and-control
Ontinue analyzed more than 10,800 suspicious ClickFix campaigns. Among confirmed malicious findings, 25.3% used blockchain-based command-and-control infrastructure, which lets operators conceal payload delivery and evade domain- and hosting-based defenses.
Researchers also found that 6,188 delivery domains resolved to only 158 payload hosts, which the company describes as growing concentration and industrialization of malicious infrastructure.
Supply-chain attacks include Shai-Hulud and AI-assisted activity
The report examines the continued evolution of software supply-chain attacks, citing Shai-Hulud and emerging examples of AI-assisted offensive activity targeting open-source ecosystems.
Balazs Greksza, Director of Advanced Threat Operations at Ontinue, said most effective attacks rely on trust rather than sophisticated exploits, making visibility, identity protection and rapid response more important.