Ethical Hacking News
A recent report by Microsoft has revealed that attackers are exploiting Microsoft Teams and Active Directory Certificate Services (AD CS) to steal company data. The attackers, who posed as IT support on Microsoft Teams, tricked employees into giving them remote control of their PCs, allowing them to access sensitive data. To protect against such attacks, Microsoft recommends secure configuration and monitoring of AD CS, as well as caution when receiving unexpected requests for remote access or support.
Companies using Microsoft Teams and Active Directory Certificate Services (AD CS) are vulnerable to a sophisticated phishing attack. The attackers used social engineering and technical exploits to gain access to the company's network. The attackers obtained remote control of employees' PCs and stole sensitive company data. The attackers exploited a template weakness in AD CS to request privileged account certificates. Microsoft recommends secure configuration and monitoring of AD CS to protect against similar attacks. Employees should be cautious when receiving unexpected requests for remote access or support.
A recent report by Microsoft has shed light on a sophisticated phishing attack that has been targeting companies using Microsoft Teams and Active Directory Certificate Services (AD CS). The attackers, who posed as IT support on Microsoft Teams, were able to trick employees into giving them remote control of their PCs, allowing them to steal sensitive company data.
The attackers used a combination of social engineering and technical exploits to gain access to the company's network. They began by messaging and calling employees on Microsoft Teams, posing as the company's own IT or help desk. They then worked from outside tenants with support-themed names to make the contact appear familiar. The employees were tricked into opening Quick Assist, a remote-help tool built into Windows, and reading the connection code back to the attackers. This gave the attackers direct, hands-on control of the workstation.
From there, the attackers dropped an archive into the Downloads folder, unpacked it into a new folder named to resemble a Windows update, and ran its contents with a portable Python, Bun, or Java runtime. The attackers used insecure AD CS settings to obtain login certificates for privileged accounts, including one for a domain controller. They then used these certificates to sign in to the domain controller and run DCSync, a tool for copying password data from Active Directory.
The attackers exploited no flaw in Teams itself. They relied on social engineering and on AD CS that had been set up insecurely. Microsoft did not tie the activity to any known group. The attackers took advantage of a template weakness known as ESC1, which allowed them to request a certificate for a privileged account without being detected.
The attackers used a technique called PetitPotam to force a domain controller to authenticate to a machine the attacker controlled. They then used the relayed login to request a certificate for the domain controller itself. With this certificate and Kerberos (PKINIT), the attackers obtained a ticket-granting ticket for the domain controller, turning a one-off relayed login into a lasting identity.
In one of the cases, the attackers obtained access to a privileged account and used it to copy data from a file server to an outside SFTP server. Microsoft reported that the attackers did not steal any data, but the incident highlights the importance of secure configuration and monitoring of AD CS.
To protect against such attacks, Microsoft recommends that staff confirm any unexpected support request through a known internal channel before sharing a screen or handing over remote control. They also recommend limiting which outside Teams tenants can reach employees and allowing only approved remote-support tools. Additionally, they suggest reviewing sign-in certificate templates for ones that let the requester name the account, or that too many users can enroll in, and removing enrollment rights that are not needed.
Microsoft also recommends requiring HTTPS and turning on Extended Protection for Authentication (EPA) on web enrollment endpoints, and turning off NTLM where possible. They also suggest turning on certificate auditing and revoking any bad certificates issued.
In conclusion, the recent attack on Microsoft Teams and AD CS highlights the importance of secure configuration and monitoring of AD CS. It also underscores the need for employees to be cautious when receiving unexpected requests for remote access or support. By following Microsoft's recommendations, companies can reduce the risk of similar attacks and protect their sensitive data.
Related Information:
https://www.ethicalhackingnews.com/articles/Attackers-Exploit-Microsoft-Teams-and-Active-Directory-Certificate-Services-to-Steal-Company-Data-ehn.shtml
https://thehackernews.com/2026/11/attackers-pose-as-it-support-on.html
Published: Mon Nov 2 06:18:28 2026 by llama3.2 3B Q4_K_M
