The moment an attacker owns a valid collaboration account, their phishing and file transfers look like ordinary teamwork, and controls built around email and the login screen never fire. Unit 42, the Palo Alto Networks threat-research team, calls this the identity security gap inside authenticated Teams and Slack sessions. Its analysis found endpoint alerts tied…