# Hackers Exploit Microsoft Teams and AD CS Vulnerabilities to Breach Corporate Data

*Published November 4, 2026*
*Source: [https://thehackernews.com/2026/11/attackers-pose-as-it-support-on.html](https://thehackernews.com/2026/11/attackers-pose-as-it-support-on.html)*

## Executive Summary

Hackers breached company networks by posing as IT support on Microsoft Teams and exploiting insecure AD CS configurations, allowing unauthorized access to sensitive data. Microsoft's analysis reveals the attacks relied on social engineering and known vulnerabilities, emphasizing the necessity for proper configuration and effective response strategies.

## Article

Cybercriminals recently infiltrated corporate networks by impersonating IT support staff on Microsoft Teams. They duped employees into granting remote access to their computers, leveraging insecure Active Directory Certificate Services (AD CS) settings to acquire privileged account certificates. Microsoft has reported two such intrusions, with one involving the unauthorized transfer of company data to an external server. The attackers did not exploit any flaws in Microsoft Teams itself but instead capitalized on social engineering tactics and improperly configured AD CS setups. 

Initially, attackers posed as help desk personnel on Teams, using familiar support-themed names to deceive employees. They persuaded users to open Quick Assist, a Windows remote-help tool, allowing the attackers direct access to the users' workstations. Once inside, they deployed malicious archives disguised as Windows updates, running them with various runtime environments.

AD CS, responsible for issuing login certificates, was exploited when attackers found a template vulnerability known as ESC1. This flaw allowed them to request certificates impersonating privileged accounts, maintaining access even after passwords were changed or devices wiped. The first wave of attacks targeted a limited number of users, and though Microsoft Defender disrupted most of the attack, one privileged account remained vulnerable. A subsequent attack wave targeted more users, resulting in additional compromised accounts.

In the second intrusion, the attackers used a technique called PetitPotam to induce a domain controller to authenticate to their controlled machine. This method, known as ESC8, allowed them to request a certificate for the domain controller without needing a password. However, Microsoft was able to contain this attack by issuing ESC8 alerts and isolating the affected workstation.

The incidents underscore the importance of properly configured systems and robust response strategies. Microsoft advises focusing on configuration and response measures, as no software flaws were involved. The report highlights how these attacks combined known techniques and illustrates the critical need for comprehensive identity containment strategies.