Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data

Attackers are impersonating IT support staff on Microsoft Teams to trick employees into granting them remote access to company computers. Once gaining access, they exploit weak settings in Active Directory Certificate Services to obtain login certificates for high-privilege accounts. This includes certificates for domain controllers, which can provide significant control over a network. Microsoft has investigated two instances of this type of intrusion, with one resulting in the theft of company data. The attackers' ability to pose as trusted support personnel allows them to bypass traditional security measures. Microsoft's report highlights the success of these tactics in two known cases.