Attackers Exploit Trusted Collaboration Platforms for Identity Abuse

Unit 42 researchers found that 99% of the alerts generated related to chat phishing operations — a stark signal that attackers are increasingly using authenticated collaboration channels, not email, as their primary vector for identity abuse.

Collaboration platforms have become an identity attack surface

Enterprise collaboration tools — Microsoft Teams, Slack and their ilk — are no longer just productivity applications. The source material states organizations connect these platforms to their identity providers and rely on them for trusted, authenticated communication. Features that improve productivity — real‑time chat, external federation, guest accounts, shared workspaces and third‑party integrations — also create pathways attackers can exploit. Because a compromised account carries the permissions, relationships and ongoing conversation context of a legitimate user, requests that would look suspicious in email can appear routine when delivered inside authenticated collaboration sessions.

Three real campaigns that show how attackers exploit trust

The report summarizes multiple incidents from late 2025 through spring 2026 that illustrate common playbooks:

• January 2026 — Fireblocks: A recruitment‑themed social engineering campaign impersonated executives and recruiters. Targets were vetted through Google Meet interviews, then given a code review task that required running npm install. The command executed malicious code and delivered malware; Palo Alto Networks notes Fireblocks assessed the activity as aligned with the “Contagious Interview” pattern attributed to North Korea‑linked actors.
• March 2026 — Axios npm maintainer: A staged Slack workspace impersonated a legitimate company and moved interactions into a staged Teams meeting. The maintainer installed software during the meeting that delivered a remote access Trojan, allowing the actor to publish two poisoned Axios versions to npm.
• April 2026 — OpenSSF / Linux Foundation communities: A threat actor impersonated a recognized community leader in Slack and sent a Google Sites link that initiated a fraudulent Google Workspace authentication flow. The site requested email and verification codes, instructed targets to install a malicious root certificate, and on macOS downloaded and executed a binary capable of providing system access.

Appliances and webhooks: persistence and covert exfiltration

Attackers are not limited to human‑facing social engineering. In December 2025, CERT Polska investigated an intrusion at a Polish manufacturer in which the actor modified compromised firewall‑VPN appliances to run scheduled scripts. One script retrieved a privileged password, another disabled two‑factor authentication for a privileged account, and a third used the appliance’s native Slack notification capability to send results to a Slack channel under the actor’s control. The case shows how built‑in automation and webhook features can be repurposed for credential theft and persistence without separate exfiltration tools.

Palo Alto Networks highlights that perimeter firewalls can reveal webhook traffic (for example HTTP POSTs to hooks.slack[.]com) and urges teams to review unexpected webhook usage, uncommon user agents, and webhook activity from systems without approved integrations.

Detection and defensive measures grounded in identity telemetry

The report emphasizes that conventional email‑and‑authentication defenses are necessary but insufficient. It recommends:

• Reduce unnecessary exposure: review and restrict external federation, guest access and third‑party integrations; limit external communications to trusted organizations and regularly remove unneeded guest accounts.
• Extend identity protections beyond login: enforce MFA and conditional access, and monitor session risk and post‑authentication behavior such as unusual messaging volumes, unexpected file shares, or contacts with unfamiliar external tenants.
• Define verification procedures: require secondary‑channel validation (known phone numbers, ticketing systems, documented internal processes) before approving MFA prompts, installing software, or sharing credentials.
• Ingest collaboration telemetry into SIEM: correlate authentication logs, messaging activity, file‑sharing events and external tenant interactions with endpoint and network telemetry (administrative changes, outbound webhooks, unusual SaaS connections).
• Make reporting easy and actionable: provide clear user workflows for reporting suspicious collaboration messages and triage using identity telemetry, sign‑in data, endpoint alerts and external tenant information.

How technologists, open‑source maintainers, and end users should respond

Technologists and security teams: prioritize monitoring of collaboration platform telemetry, include network appliance automation in coverage, and flag unexplained outbound webhook traffic and configuration changes. Correlate collaboration events with endpoint alerts and identity logs in a SIEM.

Open‑source maintainers and community operators: treat unexpected recruitment or project invitations, staged workspaces, and requests to run setup commands with high suspicion; verify high‑risk requests via a secondary channel and restrict what privileged maintainer accounts can do without additional approval.

End users and employees: do not approve MFA prompts, install remote access tools, provide credentials, or run requested commands based solely on a message inside a collaboration platform; verify security‑sensitive requests through a known phone number, ticketing system or other documented process.

Identity is now a primary enterprise boundary, and Palo Alto Networks underscores a clear refrain from the findings: authentication alone is not sufficient. Organizations must observe — and be able to act on — how authenticated identities use collaboration channels after sign‑in. For help with suspected compromises, the Unit 42 Incident Response team is listed as the contact point in the report.

Read the original Unit 42 report: https://unit42.paloaltonetworks.com/communication-channel-identity-risks/