Cybercriminals Exploit Microsoft Teams Social Engineering and Weak AD Certificate Settings to Harvest Enterprise Credentials

Security researchers have uncovered a coordinated campaign in which attackers masqueraded as IT support staff on Microsoft Teams, persuading employees to hand over remote access to their workstations. Once in control, the hackers leveraged poorly configured Active Directory Certificate Services (AD CS) to generate authentication certificates for high‑privilege accounts, including a domain administrator, enabling them to move laterally and exfiltrate sensitive data.

The deception began with convincing messages sent through Teams, a platform widely adopted for internal communication and support. Victims received prompts that appeared to originate from the organization’s help desk, requesting screen sharing or remote control to "resolve" routine issues. In many cases, employees complied, unaware that the session was being hijacked by malicious actors.

After establishing a foothold, the intruders turned their attention to the network’s AD CS infrastructure. AD CS is designed to issue digital certificates that authenticate users and services within an Active Directory environment, but it can be abused if misconfigured. The attackers identified settings that allowed certificate enrollment without sufficient validation, enabling them to request and obtain certificates for privileged accounts without triggering alerts.

One of the most consequential outcomes was the creation of a valid login certificate for a domain‑admin account. Possessing such a certificate grants the holder unrestricted access to the domain, effectively bypassing traditional password‑based defenses. With this level of access, the threat actors could enumerate resources, deploy additional malware, and extract proprietary information from compromised servers.

Experts say the attack highlights two persistent challenges for enterprises: the human element of social engineering and the technical pitfalls of certificate management. While multi‑factor authentication and strict remote‑access policies can mitigate the risk of unsolicited Teams sessions, many organizations still lack rigorous controls over AD CS enrollment policies, leaving a gap that can be exploited at scale.

In response, security teams are advised to audit AD CS configurations, enforce least‑privilege enrollment permissions, and monitor certificate issuance logs for anomalous requests. Additionally, organizations should reinforce user awareness training that emphasizes verification of support requests, especially when they involve granting remote control.

The findings were first reported by The Hacker News, prompting several large enterprises to initiate internal reviews of their Teams usage and certificate services. As attackers continue to blend social engineering with technical exploitation, analysts anticipate that similar campaigns will emerge, targeting other collaboration tools and misconfigured identity services.

Moving forward, industry groups are urging Microsoft to tighten default security settings for Teams and AD CS, and to provide clearer guidance on securing remote support workflows. Until such measures become standard, vigilance on both the technical and human fronts remains the most effective defense against these hybrid attacks.