Skip to content
Phishing Attacks Exploit Microsoft Teams for Credential Theft

Phishing Attacks Exploit Microsoft Teams for Credential Theft

First seen 13 Oct 2026, 22:05 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 00:08 UTC
  • •30% of organizations monitored faced IT support impersonation via Microsoft Teams.
  • •Shai-Hulud npm worm targets developer credentials and spreads through software supply chains.
  • •Device-code phishing attacks confirmed across multiple sectors, allowing token theft.

In 2026, attackers increasingly impersonated IT support via Microsoft Teams to steal credentials and spread malware. Ontinue's report noted that 30% of monitored organizations experienced such impersonation attempts, with one in every 990 external contacts showing signs of fraud. The Shai-Hulud npm worm was identified as a significant threat, targeting developer credentials to propagate through the software supply chain. Additionally, device-code phishing attacks were confirmed across various sectors, allowing attackers to obtain refresh tokens and manipulate legitimate authentication methods. The report indicates that these tactics are becoming more common, leveraging trusted identities and services to gain unauthorized access. Organizations are urged to enhance security awareness and training to defend against these social engineering tactics.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-13
Ontinue's threat report published
The report reveals a rise in phishing attacks using Microsoft Teams and npm packages, affecting numerous organizations.
Hackread
2026-10-13
ReliaQuest report on vishing and Teams phishing
The report highlights a surge in voice phishing and Teams impersonation by extortion groups, targeting unmanaged devices.
Blog.Knowbe4

More articles in this cluster (4)

Following this threat?

Track Black Basta, ShinyHunters and ClickFix in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (19)

1 / 3

Common questions

How are attackers impersonating IT support?
Attackers contact employees via external Microsoft Teams accounts, posing as internal IT support to gain access.
What sectors are most affected by these attacks?
The attacks have impacted sectors including professional services, industrial automation, financial services, and research.
What can organizations do to mitigate these threats?
Organizations should enhance security awareness training and implement strict verification processes for unsolicited support requests.