https://www.helpnetsecurity.com/2026/07/01/artoken-phishing-panel-microsoft-365-accounts/

By Sinisa Markovic - Managing Editor, Help Net Security

July 1, 2026

Recently there have been continued upticks in phishing/cyberrobbery through online currency platforms and it’s making its way all over the internet. Malware called ARToken 7 EvilTokens are deployed from one click. The deception is that they’re spoofing accounts-payable contact as a real contractor and reaching payment recipients by sending 2 nearly identical emails. The link within is disguised to look like the chosen vendor’s information but is actually an attacker-controlled Microsoft workspace that starts stealing data as soon as it’s accessed. They use a geo-aware template that drops a victim’s city and country into the lure. Multiple moving parts make up a working business email compromise environment.

https://unit42.paloaltonetworks.com/microsoft-teams-phishing/

Bill Batchelor

June 8 2026

Another common deception online is specifically aimed at users of Microsoft Teams. Users receive externally marked message on Teams coming from “IT Department”.  Understandably, something coming from ‘within teams’ seems legit at first glance. The cybercriminals pose as IT employees trying to contain a data leak. They ask for 2FA information like birthdate, legal name, ID info, etc. Awareness of email phishing has increased and users are way more likely to be tricked by a message from a ‘legitimate’ collaborative platform than by a suspicious email.