Attackers Exploit Microsoft Teams Flaws to Manipulate Messages and Fake Notifications

According to Check Point Research, four critical vulnerabilities in Microsoft Teams could allow attackers to impersonate executives, manipulate messages, alter notifications and forge identities during video and audio calls, undermining trust for the platform’s 320 million monthly active users. The flaws include spoofing and notification manipulation, with CVE-2024-38197 and affected products listed as Microsoft Teams (Web, iOS, Android) and a CVSS score of 6.5.

Attack vectors enable editing messages by changing the clientmessageid parameter, spoofing notifications with false sender identities, and altering display names or caller identities during calls.

Check Point Research disclosed the issues to Microsoft on March 23, 2024, and Microsoft subsequently issued patches across different timelines: the message editing flaw fixed on 8 May 2024, the display name manipulation issue on 31 July 2024, the notification spoofing vulnerability fixed on 13 September 2024, and the caller identity spoofing flaw addressed by the end of October 2025, with all vulnerabilities remediated across Teams platforms.

The article notes that external guest users and malicious insiders could exploit these vulnerabilities, potentially enabling malware delivery and credential harvesting through impersonation.