Identity Abuse Through Trusted Communication Channels

Published August 20, 2026

Attackers are breaking into work chat apps like Microsoft Teams and Slack and using the stolen identity to message coworkers, IT staff or open-source maintainers, tricking them into handing over logins or installing remote access tools. Because the message comes from what looks like a real coworker or a trusted chat workspace, victims trust it far more than a normal phishing email.

Report priority
Medium

How it works

An attacker first phishes or otherwise takes over someone's login for a work chat platform, or builds a fake but convincing chat workspace with real-looking branding and message history, then uses that trusted channel to send links, MFA prompts or install requests that look like normal workplace conversation.

What to do

Most people are not directly affected, but you should be cautious if you have recently received an unexpected Teams or Slack message from someone posing as IT support, a recruiter or a community leader asking you to approve a login prompt, install software or run setup commands.

There is no patch since this is a technique, not a software bug, so verify any unusual chat request through a separate known channel, such as a phone call, before approving MFA prompts, installing anything or sharing credentials, and report the message to your security team.

Technical details

A threat actor builds a fake but convincing Slack workspace, complete with company branding, channels and message history, impersonating a legitimate company. They contact the lead maintainer of the Axios npm package and move the conversation to a staged Microsoft Teams meeting. The maintainer is persuaded to install software that turns out to be a remote access Trojan. The attacker uses that access to reach the maintainer's npm account and publishes two poisoned versions of the Axios package, so any project that installs those releases pulls in a malicious dependency.

Unit 42 reports that alerts tied to malicious collaboration-tool activity have more than quadrupled over the past year, with 99% linked to chat-based phishing that leads to account compromise. Once an attacker controls a Teams or Slack identity, they inherit its permissions and ongoing conversations, letting requests that would look suspicious in email pass as routine internal chat. Documented cases include APT29 impersonating IT support in Teams, an attacker-controlled Slack workspace used to steal npm maintainer credentials and publish poisoned Axios packages, a fake Slack workspace targeting Linux Foundation TODO Group members, and a Polish manufacturer's firewall-VPN Slack integration abused to exfiltrate credentials after compromise.

References

View Original Source