As the global north prepares for the return to a more active working rhythm after summer holidays, security specialist Kaspersky has warned that cybercriminals are just as keen to get back to work – with workplace communications a top target.
The company’s analysis of the past 12-months shows how attackers continue to exploit trusted business tools: specifically, Kaspersky detected 4,7-million attempted attacks involving content mimicking popular workplace services including Zoom, Outlook, OneDrive and others.
After the international summer period, employees often return to a more active working rhythm: projects resume, teams reconnect, and the number of emails, meetings, and shared files increases. This transition creates conditions that cybercriminals can exploit.
A fake video-call invitation may appear among legitimate meetings, a malicious attachment may be disguised as a business document, and a phishing page may imitate a familiar cloud storage or email service. When employees are processing a high volume of routine communications, a fraudulent message may be more difficult to distinguish from a genuine one.
From July 2025 to June 2026, Kaspersky detected 4 781 846 attempted attacks involving content associated with widely used workplace platforms.
Zoom was the most frequently abused name, accounting for 2 658 283 attempted attacks. Outlook ranked second with 1 546 122 detections. Cybercriminals also used content associated with OneDrive, which accounted for 197 030 attempted attacks, Microsoft Excel with 151 948, and Microsoft Teams with 111 402.
The largest threat category detected during the period was Downloader, with 2 733 204 cases. Such programs may download and install additional software on a device, potentially introducing further unwanted or malicious components.
Trojans were the second-largest category, accounting for 989 377 detections. These malicious programs disguise themselves as legitimate files or applications and may steal data, monitor user activity, provide attackers with remote access to a device, or install additional malware. Exploits, which may take advantage of vulnerabilities in software or operating systems to compromise a device, followed with 341 165 cases.
Many of the phishing schemes identified by Kaspersky were designed to compromise corporate accounts.
Some of the schemes used a more sophisticated device code phishing technique.
Instead of asking the victim to enter a password directly on a fake login page, the phishing site displayed a one-time code and instructed the user to copy it. The code was generated as part of Microsoft’s legitimate Device Authorisation Grant flow, which allows users to authenticate on devices with limited input capabilities. The attackers initiated this authorisation process for their own application and tricked the victim into entering the code on a genuine Microsoft login page.
By completing the authentication process – potentially including multi-factor authentication – the user could unknowingly authorise an application controlled by the attackers.
Unlike traditional phishing, the victim’s Microsoft credentials are not directly exposed; instead, attackers obtain access through an authorisation token issued by Microsoft after the user approves the request. This can allow them to access emails, OneDrive files or Teams messages. The use of an official Microsoft page makes this attack particularly deceptive, as checking the domain alone may not reveal the threat.
The other corporate-related threats tracked by Kaspersky experts also included fake interview invitations impersonating Google’s recruitment team.
The messages claimed that the recipient’s professional background had attracted the company’s attention and invited them to schedule an introductory call through an embedded link. Notably, these phishing emails were distributed via Google AppSheet, a legitimate Google-owned platform, and were sent from a genuine AppSheet address. Attackers abused the service to deliver fraudulent content while making the messages appear more trustworthy. The embedded link, however, redirected recipients to a phishing website designed to collect personal information and account credentials.
This type of lure may be especially convincing at the start of the new business season, when companies resume recruitment activity and professionals are more likely to receive messages from recruiters.
The use of a legitimate service such as AppSheet adds another layer of credibility to the scheme, while the personalised career opportunity is designed to spark curiosity and encourage recipients to follow the link before verifying the vacancy through the company’s official careers website.
“After the international summer period employees will receive meeting invitations, documents, account notifications, and requests from both familiar and new contacts,” says Evgeny Kuskov, lead security researcher at Kaspersky. “Cybercriminals understand this context and may imitate exactly the tools people expect to encounter during the working day. The danger is not necessarily an obviously suspicious message, but one that looks ordinary enough to be opened without a second thought.”