Hackers Impersonate IT Help Desk on Microsoft Teams to Hijack Active Directory Accounts and Steal Data

Attackers impersonated IT help desk personnel on Microsoft Teams to gain unauthorized access to Active Directory environments by social engineering users into sharing Quick Assist remote support session codes. They exploited misconfigured Active Directory Certificate Services using ESC1 and ESC8 attack paths, obtained certificates for privileged accounts, performed DCSync operations to harvest credentials, and exfiltrated data via Rclone to external SFTP servers. Another intrusion used PetitPotam to coerce domain controller authentication and relay NTLM credentials to obtain unauthorized certificates. These attacks did not exploit vulnerabilities in Microsoft Teams itself but relied on impersonation and legitimate remote access tools combined with Active Directory misconfigurations.

• From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion pathsMalware2026-10-30
• Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial AccessCampaign2026-10-26
• Akira Ransomware Attack InvestigationMalware2026-10-07
• PAYLOAD ransomware attacks through Active Directory GPOMalware2026-09-21
• Hackers Use Fake ChatGPT Plus Billing Emails to Steal Credit Card Details and OTP CodesCampaign2026-11-02