Ontinue Threat Intelligence Report Finds Nearly One-Third of Organizations Targeted by Fake IT Support Scams on Microsoft Teams

1H 2026 Research Reveals Growing Abuse of Trusted Identities, Collaboration Platforms, and Business Workflows as Attackers Scale Operations while Reducing the Cost of Attack

ZÜRICH, Switzerland, Oct. 13, 2026 /PRNewswire/ -- Ontinue, a leading MXDR partner providing nonstop managed security operations through its Agentic SOC, today released its 1H 2026 Threat Intelligence Report revealing that approximately 30% of monitored organizations experienced at least one fake IT support impersonation attempt through Microsoft Teams during the first half of 2026. The report also found that attackers are increasingly abusing trusted identities, collaboration platforms, software supply chains, and routine business workflows to achieve greater impact with less effort.

Drawing on observations from incident investigations, threat intelligence research, and telemetry from Ontinue's Advanced Threat Operations team, the findings reveal that rather than investing in increasingly sophisticated malware, cybercriminals are achieving greater scale by exploiting trust. Throughout the first half of 2026, Ontinue observed attackers repeatedly abusing legitimate identities, Microsoft services, collaboration platforms, software supply chains, and routine business processes to blend into normal activity and evade detection.

"The majority of effective attacks today don't rely on sophisticated exploits. They rely on trust," said Balazs Greksza, Director of Advanced Threat Operations at Ontinue. "Whether it's an attacker impersonating IT support through Microsoft Teams, abusing legitimate authentication workflows, or hiding command-and-control infrastructure within trusted services, we're seeing cybercriminals focus on blending into everyday business activity. That makes visibility, identity protection, and rapid response more important than ever."

Identity Attacks Continue to Dominate

Identity remained one of the most prevalent themes observed across the first half of 2026. The report details multiple cases of device-code phishing, tokentheft, credential harvesting, session hijacking, and abuse of legitimate Microsoft authentication workflows.

Among the findings, Ontinue identified 10 confirmed device-code phishing compromises across five customer tenants between May and June 2026, demonstrating how attackers can gain access through legitimate Microsoft authentication experiences without ever stealing a user's password.

The report also highlights the growing industry transition toward passkeys and phishing-resistant authentication as organizations work to reduce the effectiveness of credential-based attacks.

Nearly One-Third of Organizations Experienced Microsoft Teams Impersonation Attempts

Microsoft Teams has become a recurring initial-access vector for threat actors impersonating internal IT support personnel. Ontinue found that approximately 30% of monitored organizations experienced at least one fake IT support impersonation attempt, while approximately one in every 990 external Teams contacts showed indicators of impersonation activity. Attackers increasingly use trusted collaboration tools to persuade employees to grant remote access or execute malicious actions without exploiting a technical vulnerability.

"These attacks work because they leverage the same tools employees use every day," said Craig Jones, Chief Security Officer at Ontinue. "The most dangerous attacks increasingly look like normal business activity. Security teams need visibility across identities, collaboration platforms, and user behavior to identify threats before they become incidents."

Attackers Move Beyond Traditional Infrastructure

The report also identifies a rapid evolution in attacker infrastructure. During an analysis of more than 10,800 suspicious ClickFix campaigns, Ontinue researchers found that attackers are increasingly relying on blockchain technology to host and deliver malicious payloads.

Among confirmed malicious findings, 25.3% leveraged blockchain-based command-and-control infrastructure, allowing operators to conceal payload delivery and evade traditional domain- and hosting-based defenses. Researchers additionally found that 6,188 delivery domains resolved to just 158 payload hosts, highlighting the growing concentration and industrialization of malicious infrastructure.

The report also examines how software supply-chain attacks continue to evolve, including incidents such as Shai-Hulud and emerging examples of AI-assisted offensive activity targeting open-source ecosystems.

Key Findings from the Report

• Approximately 30% of monitored organizations experienced at least one Microsoft Teams IT-support impersonation attempt.
• Approximately 1 in every 990 external Teams contacts showed signs of impersonation activity.
• Ontinue identified an uptick of device-code phishing compromises.
• More than 25% of confirmed ClickFix findings leveraged blockchain-based command-and-control infrastructure.
• Researchers observed 6,188 delivery domains tied to just 158 payload hosts, highlighting the increasing industrialization of attacker infrastructure.
• Attackers are increasingly achieving scale through trusted identities, legitimate platforms, automation, and mature criminal ecosystems

Read the full report here.

About Ontinue

As a leading provider of AI-powered managed security operations, Ontinue is on a mission to give every organization the freedom to focus on what they do best; by making nonstop security excellence accessible, not just aspirational. By combining advanced AI with deep human expertise, Ontinue delivers managed security operations that are tailored to each organization's unique environment, operational needs, and risk profile.

Ontinue's ION SecOps Platform integrates AI-driven insights, automation, and real-time collaboration to continuously prevent, detect, and respond to threats. With deep expertise in Microsoft security technologies, Ontinue helps customers maximize the value of their existing investments while achieving stronger, more scalable security outcomes.

Continuous protection. AI-powered Nonstop SecOps. That's Ontinue.

Alison Raymond - [email protected]

SOURCE Ontinue