Unit 42: Identity Phishing via Enterprise Collaboration Tools

Thu, 20 Aug 2026 11:39:11 +0000

Engineer — Learn: Research on how attackers abuse trusted communication channels (Slack, Teams, email) for credential theft; review OIDC/SAML trust configurations and conditional access policies as a follow-up architecture exercise.
SOC/IR — Plan: Unit 42 analysis of TTPs for collaboration-tool identity phishing is worth building detections around this quarter — prioritize tuning alerts for anomalous OAuth consent grants and unusual login sources following collaboration-platform interactions.
Leader — Skip

Collaboration-Tools on CuraSec