MS Teams Phishing, ClickFix and Shai-Hulud npm Attacks Dominate Threat Report

Attackers are increasingly abusing trusted platforms — Microsoft Teams, npm, and Microsoft's device-code authentication flow — to bypass traditional security controls and deceive users into granting access or executing malicious code. The Shai-Hulud npm worm exemplifies supply chain risk, where a single compromised package can steal developer credentials and propagate malware broadly across ecosystems. Impersonation of IT support on Teams exploits implicit user trust in internal tooling, making social engineering harder to detect. These combined tactics highlight that perimeter defenses alone are insufficient when attackers operate from within legitimate channels. Organizations must treat trusted platforms as potential threat vectors and invest in both technical controls and user education.