[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwFMNngXxDbzN3up12ndxsEJWDToh6eLmYX04Y-RIVy8":3},{"article":4,"iocs":53,"watch_terms":57,"solutions":58,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"4fe1c795-ff20-498b-8d3a-0d8efa38deae","MS Teams Phishing, ClickFix and Shai-Hulud npm Attacks Dominate Threat Report","ms-teams-phishing-clickfix-and-shai-hulud-npm-attacks-dominate-threat-report-ca8403","Ontinue’s 1H 2026 threat report shows attackers increasingly abusing Microsoft Teams, npm packages, device-code logins and blockchain ClickFix…","Ontinue's 1H 2026 Threat Intelligence Report highlights a shift towards abusing legitimate tools like Microsoft Teams and npm packages for cyberattacks. Attackers are impersonating IT support on Teams and exploiting the Shai-Hulud npm worm to steal developer credentials and spread malware through the software supply chain. The report also details abuses of Microsoft's device-code login flow for phishing and the use of blockchain infrastructure in ClickFix attacks.","Ontinue's report details attackers abusing MS Teams, npm, device-code logins, and blockchain ClickFix.","https:\u002F\u002Fhackread.com\u002Fms-teams-phishing-clickfix-shai-hulud-threat-report\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fms-teams-phishing-clickfix-shai-hulud-threat-report.jpg","2026-10-13T15:57:29+00:00","2026-10-13T16:00:10.219865+00:00",8,[17,20,22,24,27],{"name":18,"type":19},"Microsoft Teams","product",{"name":21,"type":19},"npm",{"name":23,"type":19},"ClickFix",{"name":25,"type":26},"Ontinue","vendor",{"name":28,"type":29},"blockchain","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[54],{"type":50,"value":55,"context":56},"Shai-Hulud","npm worm targeting developer credentials and spreading through the software supply chain.",[25,18,21],{"controls":59,"vendors":143},[60,89,116],{"slug":61,"name":62,"problem":63,"products":64},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":90,"name":91,"problem":92,"products":93},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[94,101,108],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":95,"product_name":98,"url":99,"description":100},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":90,"product_name":105,"url":106,"description":107},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"slug":117,"name":118,"problem":119,"products":120},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[121,127,135],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":122,"product_name":123,"url":125,"description":126},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":161},"legitimate-tools-weaponized-teams-phishing-npm-worms-and-device-code-abuse","Legitimate Tools Weaponized: Teams Phishing, npm Worms, and Device-Code Abuse","Attackers are increasingly abusing trusted platforms — Microsoft Teams, npm, and Microsoft's device-code authentication flow — to bypass traditional security controls and deceive users into granting access or executing malicious code. The Shai-Hulud npm worm exemplifies supply chain risk, where a single compromised package can steal developer credentials and propagate malware broadly across ecosystems. Impersonation of IT support on Teams exploits implicit user trust in internal tooling, making social engineering harder to detect. These combined tactics highlight that perimeter defenses alone are insufficient when attackers operate from within legitimate channels. Organizations must treat trusted platforms as potential threat vectors and invest in both technical controls and user education.",[149,150,151,152,153,154,155,156,157,158,159,160],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-161: Supply Chain Risk Management","NIST AC-17: Remote Access","NIST SI-3: Malicious Code Protection","NIST IA-2: Identification and Authentication","NIST SP 800-218: Secure Software Development Framework (SSDF)","GDPR Article 32: Security of Processing","MITRE ATT&CK T1195: Supply Chain Compromise","MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1528: Steal Application Access Token",{}]