Cybercriminals exploit trusted services and collaboration tools to manipulate corporate data

Cybercriminals are evolving their tactics to manipulate the digital information used for corporate decision-making. Beyond traditional email interception, attackers are increasingly targeting collaboration platforms to execute sophisticated Business Email Compromise (BEC) attacks.

A joint investigation by Rapid7 and Zimbra identified over 50 vulnerabilities in the Zimbra Collaboration Suite. These flaws allow attackers to send messages on behalf of others, alter the visibility of emails, and modify shared documents or calendars without needing login credentials.

Additionally, a trend known as ‘Living Off Trusted Services’ (LOTS) is on the rise. According to KnowBe4’s Phishing Threat Trends Report Vol. 7, attackers are abusing the infrastructure of legitimate services such as DocuSign, SharePoint, Adobe Sign, Dropbox, and Google Drive. By using these established platforms, criminals can bypass secure email gateways and spam filters. Data from June to August 2026 showed that nearly one in ten recorded threat emails utilized LOTS techniques, often using ‘document sharing’ as a primary lure to steal credentials or distribute malicious payloads.