Cybersecurity researchers have observed a significant increase in threat actors exploiting enterprise collaboration platforms for identity-focused attacks, including phishing, impersonation, credential theft, and malware delivery. Over the past year, alerts related to malicious activity involving these tools have quadrupled, indicating a growing trend in their misuse.
The shift to software-as-a-service (SaaS) and the widespread adoption of platforms like Microsoft Teams and Slack have made them critical components of business operations, but also expanded the enterprise attack surface. Attackers are leveraging the inherent trust users place in these platforms, along with features such as external federation, guest access, and shared workspaces, to conduct sophisticated social engineering campaigns.
One of the most common techniques involves identity phishing through external collaboration channels. Attackers often compromise accounts or create attacker-controlled workspaces to impersonate IT support or other trusted personnel. They initiate conversations, then direct victims to phishing sites designed to harvest corporate credentials and multifactor authentication (MFA) tokens, sometimes using adversary-in-the-middle (AiTM) phishing proxies.
For example, the advanced persistent threat group APT29 has been observed using compromised Microsoft Teams accounts to send links to credential-harvesting pages. These campaigns often begin with a chat request, followed by instructions to visit a phishing site, approve an MFA request, install remote access software, or provide credentials.
Another documented technique involves attackers impersonating administrators or employees within targeted organizations via Slack. They send phishing links through direct messages, channel mentions, and legitimate notifications. Once an account is compromised, attackers inherit the user's identity context, including permissions and relationships, making their malicious activity appear as normal collaboration.
Beyond initial access, threat actors are also using collaboration platforms for post-compromise operations. This includes impersonation through legitimate platform notifications and direct messages, as well as persistence techniques like MFA removal and privileged credential exfiltration. One observed method involved using a native Slack webhook integration to exfiltrate privileged credentials.
In a recent incident, a threat actor sent a malicious RAR file containing an older, known malicious DLL (lpk.dll) to a victim via a Teams chat. The victim downloaded and opened the archive, which then launched WinRAR.exe and extracted the malicious DLL, intended for DLL sideloading attacks. This demonstrates that attackers continue to utilize older malware families when delivered through these trusted communication channels.
Security teams often have limited visibility into activity within authenticated collaboration sessions, as controls typically focus on email and authentication events. This blind spot allows attackers to exploit the trust associated with these platforms, making their requests appear routine rather than suspicious.
Organizations are advised to treat collaboration environments as part of their identity attack surface. Protecting these platforms requires both strong authentication mechanisms and enhanced visibility into how trusted identities and communication channels are used post-authentication.
