Phishing Through Collaboration Tools
Attackers now phish through work chat and collaboration apps, posing as IT support or colleagues from outside the organization. How it works and settings and habits that help.
As email filters improve, attackers are moving to places people trust more: work chat and collaboration tools. A message pops up from "IT Helpdesk" in your chat app, or a shared file arrives in a channel. Because it is inside a work tool, it feels internal and safe.
Common collaboration-tool attacks
- External "IT support" chats offering to fix a problem, then asking you to allow screen sharing or remote access. See remote access requests.
- Fake file shares leading to sign-in pages. See document share phishing.
- Compromised colleague accounts sending links in channels.
- Email floods followed by a chat: attackers bombard your inbox with spam, then contact you on chat pretending to help fix it.
Warning signs
- An "External" label on a chat or user.
- Unexpected contact from support you did not request.
- Requests for codes, screen sharing or software installs.
- Links to sign-in pages or downloads.
"External" plus "IT support" is a classic combination. Real IT usually contacts you through known internal channels.
Settings and habits
- Organizations: restrict external chat to approved partner organizations where possible, and label external users clearly.
- Everyone: verify unexpected support contact through your known IT channel.
- Report suspicious chats using your app's report feature or to IT.
Got an odd chat message? Paste it into CyberWatch AI Scan for a free check.
For all the types of phishing, read our complete guide.
Frequently asked questions
Can outsiders message me in my work chat app?
In many setups, yes: external users or other organizations can start chats. Apps usually label them as external, which is an important warning sign.
Why is chat phishing effective?
People trust internal tools more than email, and chat feels informal and urgent.
What should I do if 'IT support' messages me in chat?
Verify through your known IT channel before clicking links, sharing codes or allowing screen sharing.
Sources
- Recognize and Report Phishing, US Cybersecurity and Infrastructure Security Agency
- Small business guide: cyber security, UK National Cyber Security Centre
- Suspicious email actions, UK National Cyber Security Centre
