Phishing · Identity · Threat Intelligence
Attackers use fake IT support on Teams to steal company data
Attackers posing as IT support on Microsoft Teams tricked employees into handing over remote access, then abused insecure certificate settings to steal company data, according to Microsoft.
Ross GrantUpdated 3 min read
The short version
Attackers tricked employees into giving them remote access by pretending to be IT support on Microsoft Teams. Once inside, they used weaknesses in how digital certificates were set up to get powerful access to company systems. In at least one case, they stole company data. Microsoft says this was not due to a flaw in Teams, but to social engineering and poor configuration.
What happened?
Attackers posed as IT support on Microsoft Teams and convinced employees to give them remote access to their computers. They then abused insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts. In one case, company data was copied to an external server. Microsoft investigated two such incidents and published advice on how to defend against these attacks, according to The Hacker News.
How the attack worked
Attackers contacted employees through Microsoft Teams, pretending to be IT support or help desk staff. They used support-themed names and came from outside the company, making their messages look familiar. The attackers convinced employees to open Quick Assist, a remote-help tool built into Windows, and read a connection code back to them. This gave the attackers direct control of the employee's computer.
Once in, the attackers dropped an archive file into the Downloads folder, unpacked it into a folder named to look like a Windows update, and ran its contents using portable versions of Python, Bun, or Java. File names were changed to blend in, but sometimes still showed the real runtime's version details.
How the flaw works
The attackers did not exploit a bug in Teams itself. Instead, they took advantage of insecure settings in Active Directory Certificate Services (AD CS). AD CS is a Windows feature that issues digital certificates for authentication. If set up incorrectly, it can let attackers request certificates that give them access to privileged accounts.
In one case, the attackers found a certificate template with a weakness called ESC1. This allowed them to request certificates for privileged accounts, even though they only had access as regular users. With these certificates, they could sign in as privileged users, including on domain controllers (the servers that manage user accounts and permissions in Windows networks).
In another case, the attackers used a technique called PetitPotam to force a domain controller to authenticate to a machine they controlled. They relayed this login to the AD CS web enrollment page, abusing a weakness called ESC8, to get a certificate for the domain controller itself. This let them create a lasting identity for the domain controller.
What was taken
In at least one intrusion, attackers copied company data to an external server. They used a renamed copy of Rclone, a file-copying tool, to move files from a file server to an outside SFTP server. Microsoft did not say how much data was taken or what kind.
The response
Microsoft investigated two such intrusions. In the first, Defender's automatic attack disruption cut off most compromised accounts, but one privileged account was missed and remained usable. This allowed the attacker to continue moving data. In the second case, the customer isolated the affected workstation quickly, and no further activity was seen.
Microsoft recommends several defences: always confirm unexpected support requests through a known internal channel before sharing screens or giving remote access; limit which outside Teams tenants can contact employees; and only allow approved remote-support tools. Organisations should review certificate templates, restrict enrollment rights, require HTTPS and Extended Protection for Authentication (EPA) on web enrollment endpoints, and turn off NTLM where possible. If a bad certificate is issued, revoke it and review active Kerberos tickets, as revocation does not cancel tickets already granted.
Has this happened before?
The certificate weaknesses (ESC1 and ESC8) and the PetitPotam technique have been known since 2021. Microsoft had already documented the Teams-to-remote-access entry method earlier in 2026. What is new here is that attackers combined these techniques in real-world intrusions, and the report highlights the risk of missing even a single privileged account during incident response.
Why it matters
This attack shows how social engineering and insecure certificate settings can let attackers bypass normal defences and steal sensitive data. Even with security tools in place, missing a single privileged account during a response can leave a company exposed.
Key points
- Attackers used Teams and social engineering to gain remote access.
- Weak AD CS settings let attackers get privileged certificates.
- Company data was stolen in at least one case.
- Microsoft recommends confirming support requests and tightening certificate controls.
- Missing a single privileged account can undermine incident response.
Sources
The Hacker News
Reference
