Hackers Impersonate IT Help Desk on Microsoft Teams to Gain Domain Admin Access via AD CS Attacks

What happened

Microsoft disclosed two intrusions on October 30, 2026, involving certificate template abuse and NTLM relay. Instead, operators combined social engineering with insecure AD CS configurations to obtain certificates representing privileged users or a domain controller. Microsoft is a software and software development company based in Redmond.

After gaining control, operators transferred archives into Downloads, extracted payloads into KB-prefixed directories under user profiles, and launched portable Python, Bun, or Java runtimes. In the first intrusion, attackers identified a certificate template vulnerable to ESC1.

Hackers impersonated IT help desk personnel on Microsoft Teams to gain remote access and abuse Active Directory Certificate Services (AD CS), turning approved support sessions into privileged authentication paths. The attacks did not exploit a Teams vulnerability.

Microsoft has not attributed the activity to a specific threat actor. Hackers Impersonate IT Help Desk on Microsoft Teams Attackers contacted employees through Teams messages and calls, posing as support staff and persuading victims to launch Quick Assist and share connection codes.

Organization-themed tenant names and support-oriented display names helped make external contacts appear familiar. These components performed host discovery and assessed certificate services, with connections to domain infrastructure over LDAPS and SMB.