Collaboration and Support Platforms Are the New Attack Surface
Zscaler, Thursday, October 8th, 2026
Zscaler warns ransomware initial access has shifted to Teams messages and remote support tools posing as IT help desks.
Citing the ThreatLabz 2026 Ransomware Report, Zscaler says ransomware initial access has largely shifted from exploits to trusted collaboration and remote support tools.
A common playbook begins with spam bombing a target's inbox, followed by a Microsoft Teams message from a fake IT help desk, meaning every governance decision about those tools is now part of the attack surface.
The post outlines controls to close the gaps attackers rely on.