Ontinue’s 1H 2026 threat report shows attackers increasingly abusing Microsoft Teams, npm packages, device-code logins, and blockchain ClickFix tactics to steal access and spread malware.[1]
Cybercriminals increasingly abuse legitimate business tools to access organizations, steal credentials, and spread malware, rather than relying only on software vulnerabilities, according to Ontinue’s 1H 2026 Threat Intelligence Report.[2] The report describes how these tactics are showing up across workpla
