Microsoft Teams Flaws Exposed: Attackers Could Impersonate Executives and Forge Caller Identity

Researchers at Check Point Research disclosed four critical vulnerabilities in Microsoft Teams that could allow attackers and malicious insiders to impersonate executives, manipulate messages, spoof notifications, and forge caller identities, undermining trust in the platform.

According to Check Point Research’s report, the flaws could enable editing sent messages without the usual “Edited” label, displaying fake notifications from high-profile individuals, altering display names in private chats, and forging caller identities in audio or video calls. One vulnerability, tracked as CVE-2024-38197, could be weaponised for social engineering, business email compromise, or malware delivery.

Check Point responsibly disclosed the vulnerabilities to Microsoft on 23 March 2024, and Microsoft classified the flaw as medium severity while CPR’s proof-of-concept demonstrated a more serious reality. Teams, launched in 2017 and now serving over 320 million monthly active users, is a cornerstone of hybrid and remote work, which CPR notes makes it a high-value target for attackers.

The findings highlight potential risks across both external guests and internal employees, with implications for executive impersonation, credential harvesting, and targeted espionage.