Ontinue’s 1H 2026 Threat Intelligence Report reveals trends in the cybercrime landscape and the realities of defenses. Almost one-third of monitored organizations were targeted in the first half of 2026 by fake IT support attacks via Microsoft Teams. These attacks begin with a chat or call about an urgent device issue from an attacker impersonating IT support. This sort of social engineering attack does not require any exploits, attachments, or malware at first contact in order to achieve success.
Signals Hiding Where Defenses Miss Them
The presence of these attacks is notable: out of nearly 400,000 external Teams contacts reviewed, one in 990 show signs of impersonation. The top signal, seen in 7.5 out of every 10,000 contacts, is the mailbox address. This is followed by the display name, seen in 5 out of every 10,000 contacts. In spite of being only the second-most common signal, display names are the focus of most detection tools.
As one of the most classic signs that users are taught to look out for, lookalike characters have historically been used to spoof email addresses in phishing attacks. In 2026, however, this signal is almost entirely absent, seen in only 0.15 out of 10,000 contacts. Deception at the level of building a believable character is no longer a major part of what these attackers depend upon, as open federation enables more plainly built identities to reach their targets.
Twenty Minutes to Compromise
Analysis of these Teams calls shows call lengths ranging from 60 seconds to over 30 minutes, with the shorter calls consistent with failed attempts, rather than stunningly efficient attacks. Regarding the calls that ended in successful compromise, the call lengths cluster around the 20-minute mark, demonstrating how long it takes for this attack to be effectively carried out. The highest-fidelity signal of this attack is an email bombing campaign followed by a Teams call from an impersonated “IT support” identity.
One Call Enables an Implant Inside Microsoft
If the target of one of these attacks is effectively deceived into believing that the attacker works in IT support, they are often all too ready to grant remote access to their device. Using Quick Assist or a single PowerShell command, the victim hands over access easily and willingly, requiring no technical prowess or exploits on the part of the attacker.
This impersonation and call tactic has been followed up by the delivery of TWINLOOT, a modular Python implant that has not been previously documented. This implant establishes command-and-control (C2) through legitimate Microsoft services, tasking through SharePoint Online dead-drops via the Microsoft Graph API. Operator access is relayed through Teams TURN infrastructure.
Infrastructure With Nothing to Seize
The Ontinue report notes the significant scale of blockchain-hosted C2 infrastructure. More than one fourth (25.3%) of malicious findings, amounting to 1,568 domains, use EtherHiding. They carry out on-chain RPC round-trip activity to attain the payload, tracing back to only six smart-contract dead-drop addresses.
The most commonly contacted endpoint, seen in 1,143 cases, is a free BNB Smart Chain testnet RPC. These trends are notable in their undermining of traditional methods of detecting and blocking such activity. Monitoring that focuses only on mainnet RPC traffic will miss this activity entirely.
Lures on Reputable Sites
Ontinue ran an automated detonation pipeline on suspected ClickFix infrastructure, with 10,818 scans returning a 58% malicious verdict. Of the delivery domains used in this activity, 6,188 resolved to 158 distinct payload hosts. Blocking these payload hosts requires a delicate balancing act of avoiding the collateral damage of broad domain blocks that may affect legitimate domains.
The median age of the delivery domains was 1,886 days, or 5.2 years. Almost three-fourths (73.3%) of these domains are older than one year, and over half (50.5%) are older than five years. This is particularly significant, as it underlines the fact that these are compromised domains of established and legitimate organizations, rather than domains set up by attackers specifically for malicious operations.
Log in on a Genuine Microsoft Page
The report also notes device code phishing as an observed trend in the threat landscape. Ontinue identified ten confirmed compromises via device code phishing across five customer tenants in May and June of 2026. These attacks are carried out through the targets completing multi-factor authentication (MFA) steps, never requiring the victim to surrender a password.
These device code phishing attacks show a progression from initial consent to full tenant enumeration in only two minutes. Some of these observed cases showed no default Sentinel alert or incident at discovery, emphasizing the critical detection gap where defenses fall short in the face of such attacks.
Passkey Fix Leaves a Gap
One common approach to the security issues raised by traditional sign-in methods—like passwords and legacy MFA—is the passkey. Unfortunately, this fix is not infallible. Passkey profiles are a group-focused method of passkey registration control, often auto-enabled for tenants without any action on their part. Unconfigured tenants are ending up with device-bound plus synced passkeys after migration.
The fallback on legacy MFA means that many adversary-in-the-middle (AitM) kits remain viable even after moving over to the passkey method. The new soft target for attackers is the Temporary Access Pass and helpdesk recovery path to compromise.
Detection Built on Sequences
These attacks are able to evade detection and prevention tools because each individual event in the attack chain can be passed off as legitimate activity, while the chain as a whole leads to compromise. The correlation of mail spikes, external calls, broker sign-ins, and device registration in monitoring and detection can help to identify these attacks in progress. Changing passkey configurations should be treated as a security event, and trust relationships should be watched closely as a major attack surface for the second half of 2026.
