Attackers Use Teams Helpdesk Impersonation to Abuse AD CS

Attackers impersonated an organisation’s IT or helpdesk on Microsoft Teams, persuading staff to share remote control via Quick Assist and thereby gain hands-on access to workstations. Microsoft described two intrusions in which the attackers operated from outside tenants under support-themed names to appear familiar, then used insecure AD CS configurations to issue login certificates. One certificate enabled access to a domain controller; the other path relied on a different template weakness.

The operation did not exploit a flaw in Teams itself, but depended on social engineering combined with poorly configured Active Directory Certificate Services, with Microsoft saying it did not attribute the activity to a named threat group. Evidence from the incidents included attackers signing in to a domain controller with a newly issued certificate and performing DCSync to copy Active Directory password data, followed by data movement to an external SFTP server via a renamed file-copying tool.

Microsoft noted that in the first case, partial identity containment reduced activity but left a viable privileged route, while in the second case, isolating a workstation halted the intrusion.

Defence guidance from Microsoft emphasises configuration and response rather than software patches. Staff should confirm unexpected support requests through internal channels; limit cross-tenant Teams access and remote-support tools; review and prune enrollment rights on certificate templates, especially those allowing the requester to name the account or enroll many users.

Organisations should enable HTTPS, Extended Protection for Authentication on web endpoints, and disable NTLM where possible; turn on certificate auditing and revoke bad certificates, while reviewing active Kerberos tickets.

In the two cases, Defender alerts and containment actions were central to stopping activity, with four Defender alerts, plus file hashes used as indicators: 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17, f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001, and 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7. Microsoft did not attribute the intrusions to a specific group or provide exact dates.