Active Directory Certificate Services
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Named in breach reports by Cyber Security NewsAttackers impersonate IT help desks on Microsoft Teams to gain remote access and abuse certificate services
- Named in breach reports by The Hacker NewsAttackers posing as IT support on Teams abused AD CS to obtain privileged certificates
- Activity reported by GBHackersHackers impersonate IT help desk on Microsoft Teams to gain domain admin via AD CS attacks
Recent news
Attackers impersonate IT help desks on Microsoft Teams to gain remote access and abuse certificate services
Microsoft investigated two intrusions in which attackers impersonated help desk staff via Teams chats and calls and got users to approve Quick Assist remote-support sessions. The attackers dropped portable Python, Bun or Java runtimes and staged scripts, then abused weak Active Directory Certificate Services configurations to obtain certificates for privileged accounts. In one case an excluded privileged account was used to exfiltrate files with Rclone to an external SFTP server, and Microsoft Defender blocked over 1,000 subsequent SMB file-access attempts.
Attackers posing as IT support on Teams abused AD CS to obtain privileged certificates
Attackers impersonated IT support over Microsoft Teams to persuade employees to grant remote control of their PCs. They then exploited insecure Active Directory Certificate Services (AD CS) configurations to obtain login certificates for privileged accounts, including a domain controller. Microsoft reported investigating two such intrusions, one of which resulted in company data being stolen; the excerpt is truncated.
Hackers impersonate IT help desk on Microsoft Teams to gain domain admin via AD CS attacks
Attackers impersonated IT help desk staff on Microsoft Teams to obtain remote access, then abused Active Directory Certificate Services to turn support sessions into privileged authentication paths. Microsoft disclosed two intrusions on October 30, 2026, involving certificate template abuse and NTLM relay. The attacks did not exploit a Teams vulnerability.