Cybercriminals are leveraging Microsoft Teams communications to masquerade as IT support, convincing staff to authorize remote access, which facilitates deeper infiltration into organizational networks. Microsoft’s analysis of two breaches highlights the vulnerability of routine support interactions to such deceptive tactics.
Social Engineering in Teams Attacks
The incidents under review did not result from any inherent Microsoft Teams flaw. Instead, they were orchestrated through a blend of social engineering techniques, legitimate remote-support software, and vulnerabilities in Active Directory Certificate Services (AD CS). AD CS issues digital certificates crucial for user and computer authentication, and its misconfigurations can be exploited by attackers.
Microsoft’s researchers uncovered the use of malicious JavaScript and Python scripts for initial system access. These findings were part of an investigation conducted on October 30. While the threat actor remains unidentified, the report outlines two paths of certificate exploitation following remote system control acquisition.
Impersonation and Remote Control
In both cases, attackers impersonated help desk personnel via Teams chats and calls, using organization-themed tenant names to make external accounts appear familiar. This tactic resembles prior attacks exploiting Teams and Quick Assist to coerce employees into granting control.
The transition to remote control was pivotal, achieved mainly through Quick Assist. Despite Microsoft’s warnings, such as “External” and “Scam suspected” indicators, employees often did not heed these alerts before permitting unexpected support requests.
Upon gaining access, attackers would place an archive in the Downloads folder and create a staging directory disguised as a software update under the user’s profile. Using portable Python, Bun, or Java runtimes, they executed code to further their reach. The attackers then surveyed system configurations before connecting with their domain infrastructure.
Exploiting Certificates for Data Theft
The first breach involved exploiting a certificate template vulnerability, enabling low-privileged users to impersonate others and obtain authentication certificates. Initial phishing targeted three users, leading to the compromise of one workstation and the procurement of certificates for three privileged accounts.
Following initial disruption, a secondary wave targeted 16 additional users, compromising another workstation and acquiring certificates for eight more privileged accounts. Though over 1,000 unauthorized SMB file-access attempts were intercepted, data theft had already commenced.
The attackers used a privileged account to access a file server, deploying a renamed Rclone utility to transfer files to an external SFTP server. This incident underscored the need for robust response strategies, including restricting external Teams access and reviewing certificate-template permissions.
Microsoft advises revoking unauthorized certificates, enforcing HTTPS and Extended Protection for authentication, and ensuring containment exclusions are swiftly reviewed to prevent leaving any access routes open.
