Microsoft Teams
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Named in breach reports by Cyber Security NewsAttackers impersonate IT help desks on Microsoft Teams to gain remote access and abuse certificate services
- Named in breach reports by The Hacker NewsAttackers posing as IT support on Teams abused AD CS to obtain privileged certificates
- Activity reported by GBHackersHackers impersonate IT help desk on Microsoft Teams to gain domain admin via AD CS attacks
- Activity reported by Microsoft Security BlogTeams help desk impersonation leads to AD CS ESC1 and ESC8 certificate abuse in two intrusions
Recent news
Attackers impersonate IT help desks on Microsoft Teams to gain remote access and abuse certificate services
Microsoft investigated two intrusions in which attackers impersonated help desk staff via Teams chats and calls and got users to approve Quick Assist remote-support sessions. The attackers dropped portable Python, Bun or Java runtimes and staged scripts, then abused weak Active Directory Certificate Services configurations to obtain certificates for privileged accounts. In one case an excluded privileged account was used to exfiltrate files with Rclone to an external SFTP server, and Microsoft Defender blocked over 1,000 subsequent SMB file-access attempts.
Attackers posing as IT support on Teams abused AD CS to obtain privileged certificates
Attackers impersonated IT support over Microsoft Teams to persuade employees to grant remote control of their PCs. They then exploited insecure Active Directory Certificate Services (AD CS) configurations to obtain login certificates for privileged accounts, including a domain controller. Microsoft reported investigating two such intrusions, one of which resulted in company data being stolen; the excerpt is truncated.
Hackers impersonate IT help desk on Microsoft Teams to gain domain admin via AD CS attacks
Attackers impersonated IT help desk staff on Microsoft Teams to obtain remote access, then abused Active Directory Certificate Services to turn support sessions into privileged authentication paths. Microsoft disclosed two intrusions on October 30, 2026, involving certificate template abuse and NTLM relay. The attacks did not exploit a Teams vulnerability.
Teams help desk impersonation leads to AD CS ESC1 and ESC8 certificate abuse in two intrusions
Microsoft Threat Intelligence investigated two human-operated intrusions that began with Teams messages and calls impersonating help desk staff, leading users to approve Quick Assist sessions. The attackers staged portable Python, Bun or Java runtimes, performed discovery and probed AD CS. In Case 1 an ESC1-vulnerable template gave certificates for privileged accounts and DCSync. In Case 2 PetitPotam and an ESC8 relay gave a domain controller certificate.