Identity Abuse Through Trusted Communication Channels

This Unit 42 report describes how attackers increasingly abuse enterprise collaboration platforms — such as Slack and Microsoft Teams — to conduct identity-focused attacks (chat phishing, impersonation, credential harvesting, malware delivery and webhook-based persistence), documents multiple real-world campaigns including APT29 and supply-chain compromises, maps the behaviors to MITRE ATT&CK, and provides detection queries and practical mitigations to extend identity controls, reduce exposure, and monitor collaboration telemetry.