Microsoft has disclosed two intrusions, published on 30 October, in which attackers posed as IT help-desk staff on Microsoft Teams and talked employees into handing over remote access. The attackers then abused misconfigured Active Directory Certificate Services (AD CS) to obtain certificates for privileged accounts and domain controllers. Microsoft stresses that neither incident exploited a vulnerability in Teams itself.

How the attacks unfolded

Both intrusions began with Teams messages and calls using organisation-themed tenant names and support-style display names. Victims were persuaded to launch Quick Assist and share connection codes. Once inside, the attackers ran portable Python, Bun or Java runtimes, mapped the network and assessed certificate services over LDAPS and SMB connections.

Two routes to privileged access

In the first case, attackers exploited a certificate template vulnerable to ESC1, which let a low-privileged account request authentication certificates for privileged identities. They obtained certificates for three highly privileged accounts, and after a second wave, eight more. In the second case, they used PetitPotam over EFSRPC to coerce domain-controller authentication and relayed it to inadequately protected AD CS web enrolment, exploiting the ESC8 weakness to obtain a domain-controller certificate.

Why passwords alone will not fix it

A certificate obtained this way can create an authentication route that survives a password reset, which is why Microsoft urges organisations to audit certificate templates and web-enrolment endpoints, restrict external Teams access, verify unsolicited support requests out of band, and ensure no privileged account is excluded from automated containment.