Fake support calls on Teams can become a route to company identities
Microsoft describes two intrusions that began with fake IT support and remote control. A password reset can leave issued certificates and active sessions usable.
Going deeper
Generated image · SecuFocus
At a glance
Key points
A Teams caller claiming to be IT asks you to open Quick Assist. Before sharing a screen or control, verify the request through an internal channel you already know. Microsoft’s October 30 analysis describes two intrusions where that approval became a path to enterprise identities. The activity did not exploit a Teams vulnerability: impersonation and insecure certificate-service configurations opened the route.
Approving remote control is the decisive step
In both cases, Teams messages or calls impersonated IT staff. Users were persuaded to approve a remote-support session, primarily through Quick Assist. Attackers then used the session to place and run their tools.
A professional display name or a legitimate support application does not establish the caller’s identity. Microsoft recommends confirming unsolicited support requests through a known internal channel and paying attention to warnings about external contacts or suspected scams.
A certificate can outlive the first compromised password
The attackers assessed Active Directory Certificate Services, the organisation’s certificate infrastructure. In one case, an overly permissive template allowed certificates for privileged identities. In the other, relayed authentication led to a certificate for a domain-controller account.
These paths, called ESC1 and ESC8 in the analysis, depend on infrastructure configuration. They do not establish that a Teams call grants the same privileges in every company. They explain why resetting the first user’s password or rebuilding that workstation may leave other access intact.
Containment must include identities and sessions
Microsoft describes different outcomes. In the first case, a privileged identity excluded from automated containment remained available and later supported data exfiltration. In the second, the customer isolated the workstation after alerts and no further progression was observed.
Responders need to correlate the call, remote session, spawned processes, accounts, issued certificates and Kerberos tickets. Certificate revocation does not retroactively cancel every ticket already issued. Containment exclusions therefore need verified compensating action, not just an acknowledged alert.
For users, the immediate action is simpler: do not provide a connection code or control to unsolicited support without verification. If a session already took place, alert your IT team through a trusted channel and retain its timing and records. Microsoft does not attribute these cases to a particular actor, and neither does SecuFocus.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.