MS Teams Phishing, ClickFix and Shai-Hulud npm Attacks Dominate Threat Report

Ontinue’s 1H 2026 Threat Intelligence Report documents criminals increasingly abusing trusted business tools — Microsoft Teams, npm packages, Microsoft device-code flows, and blockchain-based ClickFix delivery — to steal credentials, maintain access, and spread malware; notable findings include IT-support impersonation across many external contacts, the Shai-Hulud npm worm impacting hundreds to thousands of packages and harvesting tokens, ten confirmed device-code phishing compromises yielding refresh tokens and persistent access, and ClickFix scans that used blockchain retrieval for a quarter of malicious payloads.