Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data
Summary: Attackers posing as IT support on Microsoft Teams convinced employees to open Quick Assist and hand over connection codes, then abused insecurely configured Active Directory Certificate Services to obtain certificates for privileged accounts, including one for a domain controller. Microsoft investigated two intrusions: the first produced certificates for three highly privileged accounts in an initial wave against three users and one workstation, then 8 more in a second wave against 16 users, and one privileged account left out of automatic containment was used to reach a file server and move data out with a renamed Rclone; the second used PetitPotam and ESC8 to obtain a domain controller certificate but was stopped by isolating a single workstation.
Why it matters: One privileged account excluded from automatic containment stayed usable and became the route to a file server and an outside SFTP server, which is why Microsoft describes partial identity containment as reducing activity while leaving a viable privileged route. There is no patch for any of this, because nothing in either intrusion was a software flaw.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026