Fake IT support calls on Teams led to stolen certificates and domain controller access
The intrusions show that certificate settings and automatic containment exclusions can matter as much as any single flaw.
Microsoft reports that attackers impersonating IT support on Teams persuaded staff to hand over remote control of their PCs, then abused insecure Active Directory Certificate Services settings to obtain login certificates for privileged accounts, one of them for a domain controller. In one of two investigated intrusions, the attackers used a certificate-template weakness to mint certificates for eleven privileged accounts, then ran DCSync on a domain controller and copied data out to an external server. One privileged account escaped Defender's automatic containment, which let the attacker keep working; in the second case, isolating a single workstation stopped the intrusion. No software patch exists because no product flaw was involved, so the remedies are configuration and response: verify unexpected support requests through known channels, restrict external Teams access and approved remote-support tools, audit certificate templates and web enrollment endpoints, and treat accounts excluded from automatic containment as explicit decisions.
Why it matters
The attacks worked by persuading staff to hand over control of their machines and then turning weak certificate configuration into access to privileged accounts, including one on a domain controller. Because one privileged account was excluded from automatic disruption, the attacker could keep working after containment had started, while the second intrusion ended once a single workstation was isolated. For organisations running Active Directory Certificate Services, the case shows that a misconfiguration rather than a patchable bug can open the door to a whole directory, and that decisions about which accounts sit outside automated response carry real consequences.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.