Attackers impersonated company IT or help-desk staff on Microsoft Teams in two intrusions investigated by Microsoft. After persuading employees to open Windows Quick Assist and share connection codes, the attackers gained direct control of their workstations and used insecure Active Directory Certificate Services (AD CS) configurations to obtain authentication certificates for privileged accounts.
The activity did not exploit a vulnerability in Teams. Instead, the attackers combined social engineering with weaknesses in certificate templates and enrollment endpoints. Microsoft did not attribute the intrusions to a known group or disclose when they occurred.
In both cases, the attackers contacted employees from external Teams tenants using support-themed names. Once connected through Quick Assist, they placed an archive in the Downloads folder, extracted it into a directory named to resemble a Windows update and ran its contents using portable Python, Bun or Java runtimes.
In the first intrusion, the attackers found an AD CS template vulnerable to ESC1, which allowed a certificate requester to specify the account represented by the certificate. They initially targeted three users and one workstation, obtaining certificates for three highly privileged accounts. Microsoft Defender's automatic attack disruption disabled the identities and ended their active sessions, but one privileged account had been excluded from the response and remained available.
Roughly 90 minutes later, the attackers targeted 16 users and another workstation, obtaining certificates for eight additional privileged accounts. More than 1,000 subsequent attempts to access files over SMB or log in were blocked, according to Microsoft.
Within seconds of acquiring one certificate, the attackers authenticated to a domain controller and ran DCSync to copy password data from Active Directory. Containment interrupted the operation, although Microsoft did not say how much credential data was obtained. The account excluded from automatic containment was later used to reach a file server, where a renamed copy of Rclone transferred data from a share to an external SFTP server. Microsoft did not disclose the amount of data copied.
The second intrusion followed the same Teams-based entry path but used a different AD CS technique. Because the ESC1 weakness was not present, the attacker used PetitPotam to coerce a domain controller into authenticating to an attacker-controlled machine. The resulting NTLM authentication was relayed to the AD CS web enrollment service through an ESC8 attack, allowing the attacker to request a certificate for the domain controller without knowing a password.
Using that certificate with Kerberos PKINIT, the attacker obtained a ticket-granting ticket for the domain controller. Microsoft said the response was effective in this case: Defender generated ESC8 alerts, the customer isolated the workstation and no further activity was observed.
Microsoft's recommendations focus on configuration and response rather than a software patch. Organizations should verify unexpected support requests through established internal channels, restrict contact from external Teams tenants and permit only approved remote-support tools. They should also review certificate templates for excessive enrollment rights or the ability to specify another account's identity.
Microsoft additionally recommends requiring HTTPS and Extended Protection for Authentication on AD CS web enrollment endpoints, disabling NTLM there where possible and enabling certificate auditing. If a malicious certificate is issued, it should be revoked, although revocation does not invalidate Kerberos tickets that were already issued. Accounts excluded from automatic containment should also have an explicit manual response assigned.
Microsoft said its report includes Defender alerts, four advanced hunting queries and three SHA-256 hashes associated with the initial-access scripts. The listed hashes are 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17, f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 and 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7.
Microsoft noted that ESC1 and ESC8 were identified in 2021, while PetitPotam was also disclosed that year. It said the incidents demonstrate how Teams-based social engineering can combine with AD CS weaknesses, and how an account left outside automated containment can preserve a privileged path. Extended Protection for Authentication is enabled by default for AD CS in Windows Server 2025; Microsoft said it must be enabled manually on Server 2022 and Server 2019.
Sources: The Hacker News.