Attackers impersonate IT help desks on Microsoft Teams to gain remote access and abuse certificate services
BREACHMicrosoft Teamsredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Criminals posed as IT support staff using Microsoft Teams messages and calls, persuading employees to approve remote control of their computers. Microsoft's investigation found that the attackers then used weak certificate settings to reach highly privileged accounts and copy files out of the network. The attacks did not exploit a flaw in Teams itself.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Verify unexpected IT support requests through a known internal channel before approving any remote access.
- Restrict external Teams access and unapproved remote-support tools.
- Review certificate template permissions and follow Microsoft's AD CS relay guidance, requiring HTTPS and Extended Protection for Authentication on enrollment endpoints.
- Revoke unauthorised certificates, review Kerberos tickets, and review containment exclusions for privileged accounts.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Malware
Companies