Executive Summary
Identity has become the primary security boundary as organizations shift toward SaaS-based collaboration. Threat actors have adapted by moving beyond traditional email phishing to exploit the high level of trust inherent in platforms like Microsoft Teams and Slack. By leveraging compromised accounts, external federation, and guest access, attackers can impersonate IT support or executives to deliver malware, harvest credentials, and bypass MFA through interactive social engineering.
Technically, these campaigns involve sophisticated multi-stage attacks, including the use of AitM (Adversary-in-the-Middle) proxies, DLL sideloading of malicious components like lpk.dll, and the misuse of native platform features such as Slack webhooks for exfiltrating privileged credentials. Notable campaigns include APT29 targeting Teams users and the Contagious Interview campaign targeting technology workers via professional recruitment scams.
The business impact is significant as these platforms often lack the same level of security scrutiny as email. A successful compromise allows an attacker to operate within the victim's identity context, inheriting their permissions and relationships to move laterally or maintain persistence through built-in automation and scheduled tasks.