Ontinue Report: Nearly One-Third of Organizations Targeted by Fake IT Support Scams on Microsoft Teams

Cybersecurity firm Ontinue has released a threat intelligence report indicating that nearly one-third of monitored organizations were targeted by fake IT support scams on Microsoft Teams during the first half of 2026. The report highlights a trend where attackers are increasingly exploiting trusted identities, collaboration platforms, and business workflows to scale operations cost-effectively.

Based on observations from incident investigations and Ontinue's Advanced Threat Operations team, the findings suggest that cybercriminals are prioritizing the exploitation of trust over developing sophisticated malware. Attackers are blending their activities into normal business operations by abusing legitimate identities, Microsoft services, collaboration platforms, and routine business processes to facilitate intrusions.

Identity-based attacks continue to be a prevalent theme. The report details instances of device-code phishing, token theft, and the abuse of legitimate Microsoft authentication workflows. Ontinue identified ten confirmed device-code phishing compromises across five customer tenants between May and June 2026, demonstrating how attackers can gain access without stealing user credentials.

Microsoft Teams has emerged as a common initial access vector, with attackers impersonating internal IT support personnel. Approximately 30% of the organizations studied experienced such attempts. Attackers leverage collaboration tools to trick employees into granting remote access or executing malicious actions without exploiting technical vulnerabilities. The report concludes that the most dangerous attacks increasingly resemble normal business activity.