Microsoft Teams Bugs Let Attackers Impersonate Colleagues and Edit Messages Unnoticed

Cybersecurity researchers disclosed details of four security flaws in Microsoft Teams that could enable impersonation and social engineering attacks, including the ability to alter message content without the “Edited” label and to modify sender information in notifications. According to Check Point in a report shared with The Hacker News, the flaws allow attackers to manipulate conversations, impersonate colleagues, and exploit notifications, affecting both external guest users and internal actors.

Microsoft has described CVE-2024-38197 (CVSS score: 6.5) as a medium-severity spoofing issue impacting Teams for iOS, which could let an attacker alter a message sender’s name. The issues were partially addressed by Microsoft in August 2024, with patches rolled out in September 2024 and October 2025, following responsible disclosure in March 2024.

The findings note that attackers can change display names in private chats and in call notifications, potentially forging caller identities and tricking victims into clicking malicious links or sharing data. Oded Vanunu of Check Point told The Hacker News that these vulnerabilities strike at the heart of digital trust and that collaboration platforms are now as critical as email and just as exposed.