Approximately one in every 990 external Microsoft Teams contacts showed at least one sign of IT support impersonation, Ontinue’s research found — and around 30% of organizations encountered at least one such contact in the first half of 2026.
Microsoft Teams as an initial access vector in the first half of 2026
Ontinue’s analysis identified Microsoft Teams as a recurring initial access vector in H1 2026, signaling a tactical shift: attackers are moving beyond single-message phishing into cross-platform, interactive deception. The research highlights that collaboration platforms themselves are being used as the opening move rather than a secondary channel after an email compromise.
Scale of internal IT support impersonation
Internal IT support impersonation is no longer rare: the research found roughly one in 990 external Teams contacts displayed at least one indicator of impersonation, and about 30% of organizations saw at least one such contact. The pattern is clear — attackers are deliberately impersonating help-desk staff or other internal-sounding identities to exploit existing trust and operational workflows.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCommon signals and attacker tactics to watch for
Security leaders quoted in the research listed a consistent set of signals and tactics that accompany these campaigns. Mika Aalto, Co-Founder and CEO at Hoxhunt, advised monitoring collaboration and endpoint indicators together: “On collaboration platforms, organizations should monitor new external identities, internal-sounding support names, repeated call attempts, and rapid movement from a chat request to a voice call.”
- Endpoints: unexpected launches of Quick Assist or other remote-management tools, PowerShell downloads, and unusual SMB or NTLM activity.
- Identity actions during unsolicited interactions: password resets, MFA changes, device enrollment, and privileged-access requests — all should be treated as high-risk events.
- Mobile-specific risks: Kern Smith, Vice President of Global Solutions at Zimperium, warned that phishing has evolved into “real-time, interactive deception designed to defeat MFA — especially on mobile devices,” often combined with coordinated vishing to weaponize identity workflows.
Security leaders’ recommended defenses and verification steps
Voices across the field in the report converge on verification and identity hardening rather than relying solely on user awareness. Aviv Nahum, Co-founder and CEO at Above Security, framed the problem bluntly: “AI isn’t eliminating the human element of cybersecurity. It’s making it much easier to exploit it.” He recommends shifting the security model from “does this look real?” to “can I independently verify that this person is who they claim to be?”
Jason Soroko, Senior Fellow at Sectigo, argued that help desks and human interactions lack cryptographic verification and suggested stronger identity proofs — “Perhaps mandatory video verification and certificate based authentication.” Shane Barney, Chief Information Security Officer at Keeper Security, urged a consistent application of zero-trust: “The practical response is applying zero-trust principles consistently, not selectively.” Louis Eichenbaum, Federal CTO at ColorTokens, also emphasized routine verification: any unexpected approach from a new number or account should be authenticated “through a previously established channel.”
What this means for identity teams, technologists, and end users
Identity teams should treat unsolicited support interactions as high-risk events and correlate identity signals — password resets, MFA changes, device enrollment, and privileged-access requests — rather than handling them in separate queues, per Mika Aalto’s advice.
Technologists and security teams are pointed to zero-trust controls, cryptographic verification, and layered defenses: mandatory verification steps, certificate-based or video verification proposals from Jason Soroko, and on-device mobile threat detection suggested by Kern Smith to blunt real-time vishing and MFA defeat attempts.
End users should expect operational changes: limits on external collaboration and remote-support capabilities, a requirement for an approved support ticket before granting access, and verification of sensitive requests through a previously known internal channel, as recommended in the research.
The throughline in the findings is simple and stark: attackers are exploiting trusted workflows and the absence of routine, independent verification. Organizations that continue to treat human-to-human support interactions as low-risk will remain vulnerable; those that require established, verifiable channels and bake identity verification into everyday processes stand the best chance of stopping interactive deception before credentials, sessions, or privileged access are weaponized.
Source: Security Magazine — Nearly 1 in 3 Organizations Face IT Support Microsoft Teams Schemes
