Cybercriminals attempted to exploit trusted workplace applications more than 4.7 million times in the 12 months to June 2026, with Zoom and Microsoft Outlook emerging as the most frequently impersonated platforms, according to new findings by cybersecurity firm Kaspersky.
Kaspersky said it detected 4,781,846 attempted attacks involving malicious content disguised as popular workplace services between July 2025 and June 2026, as cybercriminals increasingly used familiar business tools to deceive employees.
Zoom accounted for the largest share of the attacks, with 2,658,283 attempted incidents recorded during the period, while Outlook followed with 1,546,122 detections.
Other workplace platforms exploited by attackers included Microsoft OneDrive, which recorded 197,030 attempted attacks, Microsoft Excel with 151,948 and Microsoft Teams with 111,402.
The findings come as businesses prepare for increased digital activity following the international summer period, when employees typically return to regular work schedules, leading to higher volumes of emails, virtual meetings, shared documents and account notifications.
Kaspersky warned that this increase in routine digital communication could provide cybercriminals with more opportunities to disguise malicious files, links and login pages as legitimate workplace messages.
According to Kaspersky, Downloaders accounted for the largest category of threats detected during the period, with 2,733,204 cases.
These malicious programmes can download and install additional software on compromised devices, potentially opening the door to further malware infections.
Trojans were the second-largest threat category, recording 989,377 detections. Kaspersky said such malware can be disguised as legitimate files or applications and may be used to steal information, monitor user activity, provide remote access or install additional malicious software.
Exploits ranked third, with 341,165 cases. These attacks seek to take advantage of vulnerabilities in software or operating systems to compromise targeted devices.
Kaspersky also identified phishing campaigns specifically designed to gain access to corporate accounts.
One of the more sophisticated methods involved device code phishing, in which attackers exploited Microsoft’s legitimate Device Authorisation Grant process.
Rather than asking victims to enter their passwords on a fake login page, attackers generated a legitimate authorisation code and persuaded users to enter it on an official Microsoft login page.
Once the victim completed the authentication process, potentially including multi-factor authentication, the attackers could obtain an authorisation token and gain access to services linked to the account.
Kaspersky said the technique could allow attackers to access emails, OneDrive files and Teams messages without directly obtaining the victim’s Microsoft password.
The use of a genuine Microsoft authentication page makes the technique particularly difficult to detect because users who check the website address may see no obvious indication that they are being targeted.
Fake Google recruitment offers used as bait
Kaspersky researchers also uncovered phishing campaigns that impersonated Google’s recruitment team.
In the schemes, recipients were told that their professional backgrounds had attracted the company’s attention and were invited to schedule introductory calls through embedded links.
The fraudulent messages were distributed through Google AppSheet, a legitimate Google-owned platform, and sent from a genuine AppSheet address.
However, the links redirected victims to phishing websites designed to collect personal information and account credentials.
Kaspersky said the tactic could be particularly effective during periods when companies increase recruitment activities, as professionals may be more receptive to unsolicited messages about job opportunities.
The cybersecurity firm said attackers were increasingly abusing legitimate digital services to make malicious communications appear credible.
“Cybercriminals understand this context and may imitate exactly the tools people expect to encounter during the working day. The danger is not necessarily an obviously suspicious message, but one that looks ordinary enough to be opened without a second thought,” said Evgeny Kuskov, lead security researcher at Kaspersky.
NITDA raises separate Zoom security alert
The Kaspersky findings come shortly after Nigeria’s National Information Technology Development Agency (NITDA) warned users of a critical vulnerability affecting certain versions of Zoom.
The warning, issued by the NITDA Computer Emergency Readiness and Response Team (NITDA-CERRT), concerned the vulnerability identified as CVE-2026-53412.
NITDA-CERRT said the flaw was linked to improper input validation and could potentially be exploited remotely over a network without authentication.
“The vulnerability is caused by improper input validation and could allow an unauthenticated attacker to remotely compromise Zoom user accounts over a network without requiring valid credentials,” the agency said.
According to the advisory, a successful exploitation could enable attackers to take over Zoom accounts and gain access to confidential meetings, chat conversations, recordings and shared files.
The agency warned that compromised accounts could also expose sensitive organisational, government and personal information and provide attackers with an avenue to impersonate legitimate users in phishing, fraud and social engineering attacks.
NITDA-CERRT said the vulnerability affects Zoom Workplace for Windows and Zoom Workplace VDI Client for Windows.
It advised affected users to update their Zoom applications immediately and implement additional security measures, including multi-factor authentication.
Kaspersky advises stronger workplace security
With workplace communications expected to increase as employees return to a more active business cycle, Kaspersky urged organisations and employees to exercise greater caution when handling digital communications.
The company advised users to verify sender addresses and inspect links before opening meeting invitations, shared documents or account notifications, noting that minor changes to domain names could indicate impersonation.
It also advised users to download workplace applications and software updates only from official websites, trusted app stores or company-approved systems.
Employees were warned against enabling macros, disabling security settings or installing additional software when prompted unexpectedly by documents.
Kaspersky further recommended the use of strong, unique passwords, password managers and multi-factor authentication for corporate email, cloud storage, collaboration platforms and other critical business services.
It also urged organisations to verify unusual payment requests, document-sharing invitations and access requests through separate communication channels, particularly when such requests are presented as urgent.
The firm recommended regular cybersecurity awareness training for employees, using realistic examples of phishing messages, fake login pages and malicious workplace notifications.
It also advised businesses to deploy reliable security solutions across corporate and personal devices used for work to detect malicious files, phishing websites and suspicious activity.
