Cybercriminals posing as IT support staff on Microsoft Teams have tricked employees into granting remote access to their computers.
The attackers then obtained powerful corporate authentication certificates that could remain valid even after passwords were reset. Microsoft disclosed the intrusions on 30 October 2026, warning that weaknesses in corporate certificate systems could leave businesses exposed despite conventional security recovery measures.
Microsoft Threat Intelligence investigated two separate intrusions involving criminals impersonating help desk personnel. They persuaded employees to approve remote-support sessions, giving the attackers access to company computers and opportunities to impersonate highly privileged accounts.
The findings expose a serious security risk. Changing a compromised password may not stop an attacker who already possesses a valid authentication certificate.
How Fake Microsoft Teams IT Calls Give Hackers Access
Both intrusions began with Microsoft Teams messages and calls from attackers pretending to represent an organisation's IT department. They used support-related display names and organisation-themed Microsoft accounts to appear legitimate.
Employees were persuaded to open Quick Assist, Microsoft's remote-support application, and provide connection codes to establish remote sessions. Once connected, the attackers could operate the victims' computers remotely.
They transferred files, executed scripts using portable software such as Python, Bun and Java, and searched corporate networks for security weaknesses.
Their main target was Active Directory Certificate Services (AD CS), which organisations use to issue digital certificates for authentication. These certificates allow users and computers to verify their identities without relying solely on passwords.
Why Changing a Password May Not Stop the Hackers
Microsoft identified two certificate-abuse techniques known as ESC1 and ESC8. In the first intrusion, attackers discovered a misconfigured certificate template that allowed them to request authentication certificates representing highly privileged corporate accounts.
The initial phishing wave targeted three user accounts and compromised one workstation. The attackers obtained certificates for three privileged accounts before Microsoft Defender disrupted their activity.
Approximately 90 minutes later, they launched another phishing wave targeting 16 users. They compromised a second workstation and obtained certificates for eight additional privileged accounts.
Unlike passwords, issued authentication certificates are not automatically revoked when an account password changes.
Microsoft explained that resetting a password or reinstalling Windows on an affected computer does not invalidate existing certificates or previously issued Kerberos authentication tickets.
Attackers holding valid certificates could therefore potentially regain access after a company changes compromised passwords. Security teams must investigate and revoke unauthorised certificates and assess existing authentication tickets separately.
Microsoft Blocked Over 1,000 Attempts, but Data Was Taken
Microsoft Defender disrupted much of the first intrusion, restricting compromised identities and blocking more than 1,000 subsequent Server Message Block (SMB) file-access attempts, along with additional logon attempts.
However, one compromised privileged account had been excluded from automated containment.
Microsoft also observed the attackers performing DCSync, a technique that can retrieve sensitive authentication information through directory replication requests to Active Directory. The security response limited further activity, but the operation had already begun.
The excluded account remained available. According to Microsoft, the attackers continued using it to access corporate systems and eventually reached a file server.
They then launched a renamed copy of Rclone, a legitimate file-transfer utility, to copy company data to an external server using Secure File Transfer Protocol (SFTP). Microsoft's report did not disclose the total volume of data taken.
The second intrusion followed a different path. Using a technique called PetitPotam, attackers forced a domain controller to authenticate to an attacker-controlled system. They then exploited an ESC8 weakness by relaying that authentication to a vulnerable certificate-enrolment service.
This allowed them to obtain a certificate representing the domain controller without knowing its password. They subsequently used that certificate to obtain a Kerberos ticket-granting ticket, enabling authentication as the domain controller.
Microsoft Defender generated alerts, prompting the affected organisation to isolate the compromised workstation. No further attack progression was observed after isolation.
Microsoft did not name the affected organisations or attribute either intrusion to a specific hacking group.
What Employees and Businesses Should Do
Microsoft stressed that the attacks did not exploit a vulnerability in Teams itself. Instead, the criminals relied on social engineering and insecure or overly permissive corporate certificate configurations.
Employees should independently verify unexpected IT support calls through trusted internal channels before approving remote-access requests.
Businesses should also restrict remote-support tools, review Microsoft Teams external-access settings and audit certificate configurations that could permit unauthorised authentication.
Security teams responding to compromised certificates should identify and revoke unauthorised certificates, review existing Kerberos tickets and examine exclusions from automated containment. Revoking a certificate does not automatically invalidate authentication tickets already issued.
The two intrusions demonstrate why recovering from a corporate cyberattack requires more than changing passwords. Even after suspicious activity has been disrupted, a valid authentication certificate could provide attackers with another route into the network.
