Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for a domain controller.

Microsoft said in a report that it investigated two such intrusions, one of which resulted in company data being copied to an external server.

The attackers exploited no flaw in Teams itself. They relied on social engineering and on AD CS that had been set up insecurely, and Microsoft did not tie the activity to any known group.

How the Attacks Began

Both intrusions started the same way, Microsoft said. The attackers messaged and called employees on Teams while posing as the company's own IT or help desk, working from outside tenants with support-themed names so the contact looked familiar.

They talked each user into opening Quick Assist, a remote-help tool built into Windows, and reading the connection code back to them. That gave the attacker direct, hands-on control of the workstation.

From there, the attacker dropped an archive into the Downloads folder, unpacked it into a new folder named to resemble a Windows update, and ran its contents with a portable Python, Bun, or Java runtime. File names alone were a weak signal, because one copy was renamed while still carrying the real runtime's version details.

What a Certificate Buys an Attacker

AD CS is the Windows role that issues the certificates users and computers present when they log in. A certificate from a poorly configured template lets whoever holds it sign in as the account it names.

Microsoft said such a certificate continues to work even after the account's password is reset or the first machine is wiped, so neither step ends the attacker's access.

Case 1: Privileged Certificates, and a Gap in Containment

In the first intrusion, the attackers found a certificate template with a weakness known as ESC1. With that kind of template, the requester can name the account the certificate will represent, so a low-privileged user can request one that stands in for a privileged account.

The first wave of calls targeted three users and one workstation, producing certificates for three highly privileged accounts. Microsoft Defender's automatic attack disruption cut those identities off and dropped their active sessions. One privileged account, though, had been left out of the automatic response, so it stayed usable.

About 90 minutes later, a larger wave hit 16 users and a second workstation, producing certificates for 8 more privileged accounts. Microsoft said more than 1,000 later attempts to reach files over SMB or to log in were blocked.

Within seconds of obtaining a certificate, the attacker signed in to a domain controller and ran DCSync, a tool for copying password data from Active Directory. The operation had already begun when containment took hold, limiting how much could be replicated. Microsoft did not say how much credential data the attacker obtained.

The excluded account was the opening. The attacker kept using it, reached a file server, and ran a renamed copy of the file-copying tool Rclone to move data from a share to an outside SFTP server. Microsoft did not say how much data was taken.

The case shows, in Microsoft's words, that "partial identity containment can reduce attack activity while still leaving a viable privileged route."

Case 2: A Certificate for the Domain Controller

The second intrusion began the same way but took a different direction because that template weakness was not present. The attacker instead used a technique called PetitPotam to force a domain controller to authenticate to a machine the attacker controlled.

That NTLM login was relayed to the AD CS web enrollment page, an abuse known as ESC8, with no password needed. The attacker used the relayed login to request a certificate for the domain controller itself. With that certificate and Kerberos (PKINIT), the attacker obtained a ticket-granting ticket for the domain controller, turning a one-off relayed login into a lasting identity.

Here the response held. Defender raised ESC8 alerts, the customer isolated the workstation, and Microsoft said no further activity followed.

The difference between the two came down to containment. In the first, automatic disruption blocked most of the attack, but the one excluded account stayed open. In the second, isolating a single workstation stopped it.

What Defenders Can Do

There is no patch, because nothing here was a software flaw. Microsoft's advice is about configuration and response.

• Have staff confirm any unexpected support request through a known internal channel before sharing a screen or handing over remote control. Limit which outside Teams tenants can reach employees, and allow only approved remote-support tools.
• Review sign-in certificate templates for ones that let the requester name the account, or that too many users can enroll in, and remove enrollment rights that are not needed.
• Require HTTPS and turn on Extended Protection for Authentication (EPA) on web enrollment endpoints, and turn off NTLM there where you can. Microsoft's KB5005413 covers this, and its Defender for Identity posture checks flag templates and endpoints exposed to ESC1 and ESC8.
• Turn on certificate auditing. If a bad certificate was issued, revoke it, but remember that revocation does not cancel Kerberos tickets already issued; review active tickets separately.
• Treat any account left out of automatic containment as a deliberate decision and assign a manual action in its place.

What Is and Isn't Known

Microsoft did not attribute the intrusions to any named group and did not give the dates on which they happened.

The methods are not new. Researchers named the ESC1 and ESC8 certificate weaknesses in 2021, and the PetitPotam coercion trick was disclosed the same year. Microsoft itself had documented the Teams help-desk-to-remote-access entry method earlier in 2026.

What this report adds is that the two techniques meet in real intrusions, along with the lesson about the excluded account.

Newer Windows is less exposed to the ESC8 step. Microsoft turned EPA on by default for AD CS in Windows Server 2025, whereas Server 2022 and 2019 require it to be enabled manually.

Indicators and Detections

Microsoft's report lists Defender alerts across Teams, endpoints, and identity signals, and four advanced hunting queries that it calls "starting points for investigation" rather than proof on their own. It also published three file hashes tied to the initial-access scripts:

• SHA-256 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 (JavaScript initial-access script)
• SHA-256 f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 (Python initial-access script)
• SHA-256 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 (Python initial-access script)

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.