A message pops up in Microsoft Teams from "IT Support". There is a problem with your account, and they need a few minutes on your screen to fix it. Most employees would say yes. That is exactly what attackers are counting on.
On 30 October, Microsoft Threat Intelligence published details of two intrusions that started this way and ended with attackers holding the keys to the company's Active Directory. Microsoft is clear that no Teams vulnerability was involved. The attackers relied on persuasion, then on weak settings inside the network.
Below we explain how the attack works and the checks every business using Microsoft 365 should run.
How the attack works
- The call. The attacker contacts an employee through Teams, by message or call, posing as IT or help-desk staff. They use a separate Microsoft 365 tenant with an organisation-themed name and a support-style display name, so the contact looks familiar.
- The remote session. The employee is talked into starting a remote-support session, mostly through Quick Assist, the tool built into Windows, and reads out a connection code. The attacker now has hands-on control of the computer. Microsoft calls this the decisive moment of the attack.
- The foothold. During the session, the attacker drops an archive into the Downloads folder, unpacks it into a folder named to look like a Windows update, and runs scripts using portable copies of Python, Bun or Java. These scripts map the computer and the network.
- The keys. The attacker then targets Active Directory Certificate Services (AD CS), the part of a Windows network that issues digital certificates. In one case, a misconfigured certificate template let them request certificates for privileged accounts and copy the domain's password data. In the other, they tricked a domain controller into authenticating to them and relayed that to the certificate web service, gaining a certificate for the domain controller itself.
- The data. In the first case, the attacker used a privileged account that had been excluded from automated containment to reach a file server and copy files to an outside server, using a renamed file-transfer tool.
The attackers were also persistent. After the first session was disrupted, a larger second wave of phishing followed about 90 minutes later. Microsoft published reports on similar Teams help-desk campaigns in April and September this year, so this is an established technique, not a one-off.
Why it works
The attack uses tools businesses trust. Teams is where colleagues talk every day, and Quick Assist is a legitimate Microsoft support tool. Nothing about the first contact looks like a classic phishing email.
It also exploits good habits. Employees are taught to cooperate with IT, and a polite, confident caller who already knows the company's name rarely raises suspicion.
Teams does help. Calls from outside the organisation are labelled External, and Teams can show a Scam suspected warning when it detects impersonation. Microsoft has also begun adding AI-powered phishing detection to Teams from early November 2026, which looks at the context of a conversation to flag impersonation even when there is no malicious link or file. But those labels only work if people know what they mean and stop when they see them.
Finally, the damage depends on what the attacker finds once inside. In both cases, weak certificate-service settings turned one compromised laptop into control of the whole domain. And in the first case, a single privileged account left out of the security response gave the attacker a way to keep going.
What to do
For everyone in the business
- Set one simple rule. IT will never ask you to start a remote session from an unexpected Teams message or call. If someone does, hang up and contact IT through a known internal number or channel.
- Take the warnings seriously. If a Teams chat or call shows External or Scam suspected, stop and verify before doing anything.
For IT teams and IT partners
- Tighten Teams external access. Allow chats and calls only with the external organisations you actually work with, and look into unfamiliar tenants with support-style names.
- Control remote-support tools. Approve one remote-support tool, limit who can use it, and restrict or remove Quick Assist if your IT team does not rely on it.
- Block scripts from user folders. Use application control, such as App Control for Business or attack surface reduction rules, to stop portable runtimes and scripts running from Downloads and other user-writable locations.
- Harden certificate services. If you run on-premises Active Directory Certificate Services:
- review certificate templates that let a requester supply their own identity
- remove web enrolment endpoints you do not need
- require HTTPS and Extended Protection for Authentication on the ones you keep
- disable NTLM on enrolment services where possible, following Microsoft's guidance
- Avoid blind spots. Do not exclude privileged accounts from automated security responses without a documented reason and a manual alternative.
- Keep the evidence. Turn on auditing for certificate requests and issuance, and keep the logs where an attacker cannot delete them.
Closing thoughts
This attack does not need a software flaw, only a convincing voice and a few minutes of someone's trust. The defence is equally human: a clear rule that staff know by heart, backed by settings that limit what one compromised laptop can reach.
At COMMPRO Technologies, we supply Microsoft 365 across the UAE and GCC and help organisations set up its email, identity and endpoint security properly, including Teams external access and Conditional Access. Want to check how exposed your organisation is? Talk to the COMMPRO team, or start with our free Website & Email Essentials Check.
