Identity Abuse Through Trusted Communication Channels
Summary: Unit 42 reports that endpoint alerts for malicious activity tied to collaboration tools have more than quadrupled over the last 12 months, with 99% of those alerts related to chat or voice phishing operations. The article describes attackers using compromised accounts, external federation, guest access and third-party integrations to conduct identity phishing, impersonation and credential theft, including APT29 sending credential-harvesting links through compromised Teams accounts and a December 2025 CERT Polska case where scripts on compromised firewall-VPN appliances sent stolen credentials to an attacker-controlled Slack channel via the appliance's native Slack notification feature.
Why it matters: Security controls focused on email and authentication events leave limited visibility into activity inside authenticated collaboration sessions, so a valid session used by an attacker can look like routine work. The CERT Polska case shows an appliance's own built-in Slack webhook carrying a privileged password out of the network without a separate exfiltration tool.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026