Exploiting Microsoft Teams: Impersonation and Spoofing Vulnerabilities Exposed

According to Check Point Research, four vulnerabilities in Microsoft Teams could allow attackers to impersonate executives, manipulate messages, alter notifications and forge identities in video and audio calls, undermining the trust users place in a widely used collaboration platform. The flaws could be exploited by both external guest users and malicious insiders, affecting Teams’ more than 320 million monthly active users.

The researchers disclosed the vulnerabilities to Microsoft on 23 March 2024, with Microsoft acknowledging the disclosure and investigating, and by October 2025 all issues were resolved, with one vulnerability—the notification spoofing flaw—tracked as CVE-2024-38197. Specific attack techniques included editing messages without the trace of edits, altering the imdisplayname for notifications, changing conversation topics in private chats, and forging caller identity in calls by manipulating payloads.

Real‑world scenarios highlighted risks such as executive impersonation, malware delivery, credential harvesting and misinformation campaigns, underscoring the need for multi‑layered defence beyond native collaboration security.