Skip to content
NewA calmer, faster ZeroHour
StoryPhishing & fraudhigh

Teams IT-support impersonation leads to remote access and AD CS abuse

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Arctic Wolf documented more than 400 Teams help-desk impersonations, and Microsoft later detailed two cases that abused AD CS after Quick Assist access.

Arctic Wolf reported on October 26 that attackers used Microsoft Teams external chat, often after flooding inboxes, to impersonate IT support across more than 400 incidents. The activity abuses default external messaging rather than a Teams vulnerability. Employees were steered to Quick Assist or other remote tools, with payload execution reported within 15 minutes and ransomware in some cases. On October 30, Microsoft described two unattributed intrusions using the same approach, then abusing misconfigured Active Directory Certificate Services through ESC1 or ESC8. One reached DCSync and data theft after a privileged account was excluded from containment.

Key facts
  • More than 400 incidents; 30–40% used default onmicrosoft.com tenant domains.
  • About half of recent paid-domain identities used the .top extension.
  • Quick Assist was most common; AnyDesk, ScreenConnect, TeamViewer, and Atera also appeared.
  • One Arctic Wolf chain used PowerShell, an Azure Blob MSI, and a Python implant.
  • Microsoft Case 1 used ESC1, then DCSync and renamed Rclone for exfiltration.
  • Case 2 used PetitPotam and NTLM relay against ESC8 Web Enrollment.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 26, 2026Arctic Wolf reports more than 400 Teams impersonation incidents. · Infosecurity Magazine
  2. Oct 30, 2026Microsoft discloses two intrusions abusing AD CS after Quick Assist. · Microsoft Security Blog

What each outlet adds

beyond the shared facts
  • Microsoft Security BlogContainment exclusion allowed exfiltration; password resets do not revoke certificates.
  • GBHackersAt least three compromises ended in encryption; prior Storm-1811 link.
  • Help Net SecurityMicrosoft first described the method in mid-2024; later seen with other gangs.
  • Dark ReadingFollow-on activity included Kerberoasting, GoldenPAC, and a second remote tool.
  • Infosecurity MagazineArctic Wolf did not name operators and recommends blocking unmanaged tenants.
Vendors
MicrosoftCisco
Products
Microsoft TeamsQuick AssistAnyDeskScreenConnectTeamViewerAteraActive Directory Certificate ServicesWindowsMicrosoft Quick AssistGitHub Copilot CLI
Threat actors
Black BastaStorm-1811Cactus3AM
Malware
Black BastaChaosPetitPotamRcloneVYPRConti
Organizations
Arctic WolfSophosCisco Talos
AI models
Claude Code

Coverage

oldest first · one row per article · UTC
  1. · 15d ago Cyber Security NewsFirst report

    Attackers impersonate IT support on Microsoft Teams to gain remote access

    An October 26 Arctic Wolf report on more than 400 incidents also describes a PowerShell and MSI infection chain.

  2. · 15d ago GBHackers

    Fake Microsoft Teams IT support used for remote access and malware

    Arctic Wolf tied more than 400 cases to external chats, inbox floods, and tools such as Quick Assist, sometimes within 15 minutes.