Hackers Steal Microsoft Teams Chats & Emails by Grabbing Access Tokens

According to GBHackers On Security, security researchers have uncovered a sophisticated method enabling attackers to steal authentication tokens from Microsoft Teams, potentially granting access to chats, emails, and SharePoint documents. The tokens act as digital keys, allowing impersonation of users without passwords and enabling readers to access Teams conversations, emails, and shared documents, as well as to send messages in the compromised account.

The attack hinges on how Teams stores encrypted data: a child process using msedgewebview2.exe writes encrypted cookies to a local database, with DPAPI-based encryption protecting the data; attackers can bypass this by extracting the encryption key from a JSON configuration file in the Teams local cache and decrypting the token with AES-256-GCM.

Researchers demonstrated a proof-of-concept tool in Rust that automates the extraction, illustrating that stolen tokens can be used with the Microsoft Graph API for malicious activities. The findings, published on 24 October 2025, recommend organisations deploy robust endpoint detection and response, monitor Teams API activity, enforce strict access controls, and ensure systems receive regular security updates and contemporary antivirus protection.