Hackers impersonate IT help desk on Microsoft Teams to gain domain admin via AD CS attacks
THREAT ACTORActive Directory Certificate Servicesredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Operators impersonated IT help desk personnel on Microsoft Teams to gain remote access, then abused Active Directory Certificate Services (AD CS) through certificate template abuse and NTLM relay to reach domain admin. Microsoft disclosed two intrusions on October 30, 2026, and stated no Teams vulnerability was exploited. The excerpt is truncated and does not give CVEs or specific mitigations, so defenders should consult Microsoft's full disclosure.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Read Microsoft's full disclosure for detection and mitigation guidance, as the excerpt is truncated.
- Verify the identity of anyone claiming to be help desk staff before approving remote access sessions.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
GBHackers
Who and what is in it
Companies