The Biggest Cybersecurity Threats of 2026 Are Hiding in Plain Sight

Published October 13, 2026 Last Updated on October 14, 2026

As we’re halfway into Cybersecurity Awareness Month, organizations around the world are investing time in training employees, reviewing security programs, and reinforcing best practices. Many awareness campaigns focus on familiar advice such as avoiding suspicious links, creating strong passwords, and spotting obvious phishing attempts. Those lessons remain important, but they often overlook a growing reality: the most effective attacks today don’t look suspicious at all.

They look like a Teams message from someone claiming to be in IT. They look like a login screen from a trusted brand. They look like a routine request from a colleague, a helpdesk technician, or a business partner. Increasingly, attackers are succeeding not by exploiting vulnerabilities, but by exploiting trust.

Our newly released 1H 2026 Threat Intelligence Report found this pattern repeated across nearly every major threat trend observed during the first half of 2026. Whether through device-code phishing, fake IT support scams, software supply chain attacks, or blockchain-hosted command-and-control infrastructure, attackers are finding ways to blend into legitimate business activity and hide within the platforms, workflows, and identities organizations rely on every day

For security leaders, this represents an important shift. The challenge is no longer simply preventing attackers from breaking in. It’s recognizing when malicious activity is hiding behind something that appears completely normal. And for employees, it reinforces why cybersecurity awareness remains one of the most important layers of defense. In a world where attackers increasingly disguise themselves as trusted people, services, and processes, a moment spent verifying a request can be the difference between stopping an attack and enabling one.

Key Findings from the Report

• Approximately 30% of monitored organizations experienced at least one Microsoft Teams IT-support impersonation attempt.
• Approximately 1 in every 990 external Teams contacts showed signs of impersonation activity.
• Ontinue identified 10 confirmed device-code phishing compromises in a two-month period
• More than 25% of confirmed ClickFix findings leveraged blockchain-based command-and-control infrastructure.
• Researchers observed 6,188 delivery domains tied to just 158 payload hosts, highlighting the increasing industrialization of attacker infrastructure.
• Attackers are increasingly achieving scale through trusted identities, legitimate platforms, automation, and mature criminal ecosystems

Trust Has Become the New Attack Surface

For years, cybersecurity teams were focused on preventing attackers from breaking into networks and systems. While that challenge still exists, many of today’s most successful attacks don’t begin with a vulnerability. They begin with a login, a conversation, or a seemingly routine business interaction.

Throughout the first half of 2026, Ontinue observed repeated examples of attackers abusing trust relationships within organizations. Identity-focused attacks continued to dominate, with techniques such as device-code phishing, token theft, credential harvesting, and session hijacking providing efficient paths into enterprise environments. Rather than compromising endpoints directly, attackers are increasingly targeting the authentication processes and identities that organizations rely on every day.

At the same time, trusted platforms are increasingly being repurposed as attacker infrastructure. Collaboration tools, SaaS applications, cloud services, software repositories, and even blockchain networks are appearing throughout modern attack chains. These platforms provide legitimacy, familiarity, and a degree of built-in trust that attackers can leverage to blend into normal business activity.

The result is that the line between legitimate activity and malicious activity continues to blur.

Social Engineering Continues to Evolve

One of the report’s most notable findings centers on the continued rise of social engineering attacks through Microsoft Teams. What was once considered a relatively niche technique has become increasingly common across the environments we monitor.

Approximately 30% of monitored organizations experienced at least one fake IT support impersonation attempt during the reporting period.

These attacks are effective because they exploit human behavior rather than technical weaknesses.

For example, an employee receives a Teams message from someone claiming to be from IT. They are told there is a problem with their device, an issue with their account, or a security concern that requires immediate attention. The attacker sounds helpful. The request appears reasonable. The tools involved are legitimate. Before long, the employee has launched a remote access session, installed a trusted support application, or executed a command supplied by the attacker.

What makes these attacks particularly challenging is that they do not resemble the traditional phishing campaigns many employees have been trained to spot. There are no obviously malicious attachments, no poorly written emails, and no glaring red flags.

Instead, attackers are embedding themselves within workflows that employees are already accustomed to following.

Technology Alone Is Not Enough

Security awareness is not simply a compliance requirement or checkbox. It is an operational security control.

Organizations should absolutely continue investing in identity protection, threat detection, security operations, and modern defensive technologies. Those capabilities remain essential. However, many of the attacks highlighted in this report ultimately depend on a human decision. Someone must approve the authentication request. Someone must trust the caller. Someone must click the link, run the command, or grant the remote access session.

That’s why Cybersecurity Awareness Month remains as relevant as ever. Employees should understand the latest threats because they encounter them directly.

Security teams cannot be everywhere, and attackers know that the workforce is busier than ever before. When people are busy, deadlines are looming, and messages appear urgent, it becomes easier to act first and verify later.

Organizations should encourage employees to slow down when something feels unusual. Verify requests through another channel. Examine who is actually making the request. Question unexpected urgency. Confirm before granting access. Those simple actions continue to stop attacks that even sophisticated security technologies may not immediately identify.

Importantly, this should not be framed as blaming employees. The vast majority of successful social engineering attacks are designed to exploit trust, familiarity, and normal human behavior. Security awareness is about empowering people with knowledge and confidence, not assigning responsibility when attackers deliberately manipulate legitimate business processes.

What Security Leaders Should Take Away

The overarching theme from the first half of 2026 is that attackers are increasingly succeeding by abusing trust rather than exploiting technology. Identity systems, collaboration platforms, software supply chains, cloud services, and business workflows all featured prominently in successful campaigns because they allow threat actors to operate within environments that organizations already trust.

For CISOs and security practitioners, that means investing not only in stronger technical controls, but also in visibility, identity protection, detection capabilities, and ongoing education. The most effective defenses will be those that combine technology, process, and informed users.

Over the coming weeks, we’ll take a deeper dive into the individual findings through a series of spotlight articles covering identity-based attacks, Microsoft Teams impersonation campaigns, software supply-chain compromise, ClickFix activity, blockchain-based command-and-control infrastructure, and other emerging techniques shaping today’s threat landscape.

The tactics may continue to evolve, but one reality remains constant: the attacks that cause the most damage are often the ones that look completely ordinary. Understanding that shift is the first step toward defending against it.

Kudos to our Advanced Threat Operations team for another great report!

You can read the full report here.  

TL;DR | 1H 2026 reinforced a consistent trend across the threat landscape: attackers are achieving greater scale by abusing existing trust relationships. Identity systems, collaboration platforms, SaaS integrations, software supply chains, and routine business processes all featured prominently in successful campaigns. The most significant threats are increasingly hidden within legitimate activity, making visibility, identity security, and rapid detection critical defensive requirements.

Check out our press release.