Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data Swati KhandelwalNov 02, 2026Social Engineering / Active Directory Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for a domain controller. Microsoft said in a report that it investigated two such intrusions, one of which resulted in company data being copied to an external server. The attackers exploited no flaw in Teams itself. They relied on social engineering and on AD CS that had been set up insecurely, and Microsoft did not tie the activity to any known group. Both intrusions started the same way, Microsoft said. The attackers messaged and called employees on Teams while posing as the company's own IT or help desk, working from outside tenants with support-themed names so the contact looked familiar. They talked each user into opening Quick Assist, a remote-help tool built into Windows, and reading the connection code back to them. That gave the attacker direct, hands-on control of the workstation. From there, the attacker dropped an archive into the Downloads folder, unpacked it into a new folder named to resemble a Windows update, and ran its contents with a portable Python, Bun, or Java runtime. File names alone were a weak signal, because one copy was renamed while still carrying the real runtime's version details. AD CS is the Windows role that issues the certificates users and computers present when they log in. A certificate from a poorly configured template lets whoever holds it sign in as the account it names. Microsoft said such a certificate continues to work even after the account's password is reset or the first machine is wiped, so neither step ends the attacker's access. Case 1: Privileged Certificates, and a Gap in Containment In the first intrusion, the attackers found a certificate template with a weakness known as ESC1. With that kind of template, the requester can name the account the certificate will represent, so a low-privileged user can request one that stands in for a privileged account. The first wave of calls targeted three users and one workstation, producing certificates for three highly privileged accounts. Microsoft Defender's automatic attack disruption cut those identities off and dropped their active sessions. One privileged account, though, had been left out of the automatic response, so it stayed usable. About 90 minutes later, a larger wave hit 16 users and a second workstation, producing certificates for 8 more privileged accounts. Microsoft said more than 1,000 later attempts to reach files over SMB or to log in were blocked. Within seconds of obtaining a certificate, the attacker signed in to a domain controller and ran DCSync, a tool for copying password data from Active Directory. The operation had already begun when containment took hold, limiting how much could be replicated. Microsoft did not say how much credential data the attacker obtained. The excluded account was the opening. The attacker kept using it, reached a file server, and ran a renamed copy of the file-copying tool Rclone to move data from a share to an outside SFTP server. Microsoft did not say how much data was taken. The case shows, in Microsoft's words, that "partial identity containment can reduce attack activity while still leaving a viable privileged route." Case 2: A Certificate for the Domain Controller The second intrusion began the same way but took a different direction because that template weakness was not present. The attacker instead used a technique called PetitPotam to force a domain controller to authenticate to a machine the attacker controlled. That NTLM login was relayed to the AD CS web enrollment page, an abuse known as ESC8, with no password needed. The attacker used the relayed login to request a certificate for the domain controller itself. With that certificate and Kerberos (PKINIT), the attacker obtained a ticket-granting ticket for the domain controller, turning a one-off relayed login into a lasting identity. Here the response held. Defender raised ESC8 alerts, the customer isolated the workstation, and Microsoft said no further activity followed. The difference between the two came down to containment. In the first, automatic disruption blocked most of the attack, but the one excluded account stayed open. In the second, isolating a single workstation stopped it. There is no patch, because nothing here was a software flaw. Microsoft's advice is about configuration and response. Have staff confirm any unexpected support request through a known internal channel before sharing a screen or handing over remote control. Limit which outside Teams tenants can reach employees, and allow only approved remote-support tools. Review sign-in certificate templates for ones that let the requester name the account, or that too many users can enroll in, and remove enrollment rights that are not needed. Require HTTPS and turn on Extended Protection for Authentication (EPA) on web enrollment endpoints, and turn off NTLM there where you can. Microsoft's KB5005413 covers this, and its Defender for Identity posture checks flag templates and endpoints exposed to ESC1 and ESC8. Turn on certificate auditing. If a bad certificate was issued, revoke it, but remember that revocation does not cancel Kerberos tickets already issued; review active tickets separately. Treat any account left out of automatic containment as a deliberate decision and assign a manual action in its place. Microsoft did not attribute the intrusions to any named group and did not give the dates on which they happened. The methods are not new. Researchers named the ESC1 and ESC8 certificate weaknesses in 2021, and the PetitPotam coercion trick was disclosed the same year. Microsoft itself had documented the Teams help-desk-to-remote-access entry method earlier in 2026. What this report adds is that the two techniques meet in real intrusions, along with the lesson about the excluded account. Newer Windows is less exposed to the ESC8 step. Microsoft turned EPA on by default for AD CS in Windows Server 2025, whereas Server 2022 and 2019 require it to be enabled manually. Microsoft's report lists Defender alerts across Teams, endpoints, and identity signals, and four advanced hunting queries that it calls "starting points for investigation" rather than proof on their own. It also published three file hashes tied to the initial-access scripts: SHA-256 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 (JavaScript initial-access script) SHA-256 f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 (Python initial-access script) SHA-256 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 (Python initial-access script) Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Active Directory, data breach, Identity Security, Microsoft, Social Engineering TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor AI-Generated Fake Login Pages Are Making Account Takeovers Easier PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Reserve My Spot Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. Accelerate Incident Response: 95% Faster Containment Cut containment time from 48 hours to 3. Read the Orchid IR case study. The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security