Attackers pose as IT support on Teams, abuse AD CS to grab privileged access

Attackers posing as a company's IT help desk over Microsoft Teams tricked employees into handing over remote control of their workstations, then abused insecurely configured Active Directory Certificate Services (AD CS) to mint certificates for privileged accounts, according to a Microsoft report summarized by The Hacker News. Microsoft published its findings on October 30, 2026, describing two separate intrusions.

What happened

According to Microsoft, as reported by The Hacker News, the attackers worked from outside Teams tenants that used support-themed names. They messaged and called employees while claiming to be the company's IT or help desk, and persuaded each user to open Quick Assist, the built-in Windows remote-help tool, and read back the connection code. That gave the attacker hands-on control of the workstation. They then dropped an archive into the Downloads folder, unpacked it into a folder named to look like a Windows update, and ran it using a portable Python, Bun, or Java runtime. Microsoft said the attacks exploited no vulnerability in Teams itself and relied on social engineering combined with insecure AD CS configuration.

Technical details

AD CS issues the certificates used for logins, and a certificate from a poorly configured template lets its holder sign in as the account it names, Microsoft said. Crucially, such a certificate keeps working even after a password reset or a wiped machine. In the first case, the template allowed the requester to name the account (the weakness known as ESC1), letting a low-privileged user request certificates for privileged accounts. In the second, the attacker used PetitPotam to coerce a domain controller into authenticating to an attacker-controlled machine, then relayed that login to the AD CS web enrollment page to obtain a certificate for the domain controller (the ESC8 weakness), and used PKINIT to get a ticket-granting ticket for it.

In the first intrusion, an initial wave produced certificates for three privileged accounts; Microsoft Defender's automatic attack disruption cut off those identities, but one account had been excluded from automatic response and stayed usable. About 90 minutes later, a larger wave produced certificates for eight more privileged accounts, and Microsoft said more than 1,000 later attempts to reach files over SMB or log in were blocked. The attacker signed in to a domain controller and began DCSync before containment limited replication, then used the excluded account to reach a file server and move data to an outside SFTP server with a renamed copy of Rclone. In the second case, Defender raised ESC8 alerts, the customer isolated the workstation, and Microsoft said no further activity followed.

Who is affected

Microsoft did not tie the activity to any known group or name the two affected organizations, The Hacker News reported. The underlying ESC1 and ESC8 weaknesses and the PetitPotam technique were all named in 2021, meaning organizations with longstanding AD CS misconfigurations remain exposed.

What to do

Microsoft recommends verifying unexpected support requests through a known internal channel before sharing a screen or granting remote control, limiting which external Teams tenants can reach employees, and allowing only approved remote-support tools. For AD CS, it advises reviewing certificate templates that let requesters name the account or that too many users can enroll in, requiring HTTPS and enabling Extended Protection for Authentication (EPA) on web enrollment endpoints, disabling NTLM there where possible, and enabling certificate auditing. Because revoking a bad certificate does not cancel Kerberos tickets already issued, teams should review active tickets separately, and any account excluded from automatic containment should be given a deliberate manual response action.