Enterprise collaboration platforms like Slack and Microsoft Teams have become a growing attack surface as threat actors exploit trusted communication channels for identity phishing, impersonation, credential theft and post-compromise persistence. Endpoint alerts tied to collaboration tool abuse have more than quadrupled over 12 months, with 99% of alerts linked to chat phishing. Real-world examples include APT29 abusing Teams federation, attacker-controlled Slack workspaces used in the Axios npm maintainer compromise, a fake recruiting campaign against Fireblocks-linked developers, an OpenSSF/Linux Foundation Slack impersonation campaign, and a CERT Polska case where attackers used Slack webhooks for credential exfiltration from compromised firewall-VPN appliances. Recommendations include reducing external federation/guest access exposure, extending identity monitoring beyond authentication, defining verification procedures for high-risk requests, updating security awareness training, and ingesting collaboration telemetry into SIEM systems alongside identity and endpoint data.
Table of contents
Executive SummaryUnderstanding Trusted Communication ChannelsReal-World Misuse of Collaboration PlatformsDefensive Measures for Securing Collaboration PlatformsConclusionAdditional ResourcesThreat Hunting QueryQuestions this post answers
How did attackers compromise the Axios npm package maintainer's account?
A threat actor used a staged Slack workspace with fake company branding, channels, and message history to socially engineer the lead maintainer of the Axios npm package, then moved the conversation to a staged Teams meeting where the maintainer was convinced to install software delivering a remote access Trojan. This gave attackers access to the maintainer's npm account, leading to two poisoned Axios versions being published that executed a malicious dependency on install. Developers relying on npm packages can follow supply chain incident writeups like this one on daily.dev.
How did the Contagious Interview campaign use fake job interviews to deliver malware to developers?
Attackers impersonated Fireblocks executives, recruiters, and HR managers, contacting technology workers through social media and scheduling video interviews via Google Meet. During the interview, a fake HR manager assigned a code review task requiring candidates to clone a GitHub repository and run npm install, which executed malicious code and downloaded malware. Fireblocks linked the activity to the North Korea-associated Contagious Interview pattern. Job-seeking developers evaluating suspicious recruiting outreach can find similar threat reports on daily.dev.
How did attackers exfiltrate credentials using Slack webhooks after compromising firewall-VPN appliances?
In a December 2025 intrusion investigated by CERT Polska at a Polish manufacturing company, attackers used a compromised firewall-VPN appliance's built-in scripting mechanism to create weekly scheduled tasks: one retrieved a privileged account's password, another disabled two-factor authentication for that account, and a third used the appliance's native Slack notification feature to send results to an attacker-controlled Slack channel, avoiding a separate exfiltration tool. Security teams hardening network appliances against webhook abuse can track incident reports like this on daily.dev.