New BOF Tool Bypasses Microsoft Teams Cookie Encryption to Steal User Chats

Cybersecurity researchers at Tier Zero Security have released a specialised Beacon Object File (BOF) tool that exploits a weakness in Microsoft Teams cookie encryption to steal user chat messages and other sensitive communications. The flaw arises because Teams relies on the current user’s DPAPI master key for cookie protection, whereas modern Chromium-based browsers use a COM-based elevator service with SYSTEM privileges to protect encryption keys.

The Teams cookie data is stored in a SQLite database and can be decrypted when the attacker has access to the user’s DPAPI master key, enabling them to obtain authentication tokens for Teams, Skype, and Microsoft Graph APIs. The new teams-cookies-bof tool runs within the ms-teams.exe process context, duplicates the cookies file handle, reads its content, and decrypts the key, allowing threat actors to read messages or impersonate the victim.

Researchers note that the approach circumvents cookies being locked while Teams is running by operating inside the process via DLL or COM hijacking. They warn that stolen tokens could be used with post-exploitation tools like GraphSpy to broaden access across Microsoft’s ecosystem.