Threat watch / Attack
Fake IT help desk calls on Teams led to certificates for privileged accounts
Microsoft describes two intrusions that began with someone posing as IT support on Teams. The attackers got users to open Quick Assist, then abused weak Active Directory Certificate Services settings to obtain certificates for privileged accounts and for a domain controller. In one case, data was copied out. No Teams flaw was used.
- Sector
- Many sectors
- Way in
- Phishing, social engineering
- Product or vendor
- Microsoft Teams, Quick Assist, AD CS
- How it happened
- Social engineering first: messages and calls on Microsoft Teams posing as IT or help desk, used to get users to grant remote access, mainly through Quick Assist. Then abuse of Active Directory Certificate Services (AD CS). Case 1: a certificate template with the ESC1 weakness gave certificates for privileged accounts. Case 2: the attacker used PetitPotam to make a domain controller authenticate to their system, relayed it to AD CS web enrollment (ESC8) and got a certificate for the domain controller. Microsoft says no vulnerability in Teams was exploited.[1][2] Checked 8 Nov 2026
- What was stolen
- Case 1: certificates for 11 privileged accounts in two waves (3, then 8, by our count of Microsoft's figures), a DCSync run within seconds of the first privileged certificate, and files copied from a file server to an external SFTP destination with a renamed Rclone. Microsoft does not say how much data was taken. Case 2: a certificate for a domain controller and a Kerberos ticket for it.[1][2] Checked 8 Nov 2026
- Who was impacted
- Two organizations, not named, with no sector given. In case 1, Defender's automatic containment restricted the compromised identities, but one privileged account was excluded from it and stayed usable. In case 2, the customer isolated the workstation after alerts and Microsoft saw no further progress.[1][2] Checked 8 Nov 2026
- Threat actor
- Not attributed. Microsoft says the activity is not attributed to a specific threat actor.
Timeline
- Microsoft publishes its investigation of the two intrusions and says the activity is not attributed to a specific actor. It advises treating containment exclusions as incident decisions, with a manual action for any account automation cannot contain. [1]
- The Hacker News reports the case. Microsoft gave no dates for the intrusions and no victim names. [2]