Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhigh

Microsoft links Teams help-desk lures to AD CS domain abuse

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Two unattributed intrusions used Teams IT impersonation and Quick Assist, then ESC1 or ESC8, without exploiting Teams.

Microsoft Threat Intelligence disclosed two human-operated customer intrusions on October 30, 2026. Operators messaged and called employees on Teams as IT support and persuaded them to approve Quick Assist; Microsoft said Teams itself was not exploited and named no actor. Attackers staged portable Python, Bun, or Java runtimes and abused misconfigured Active Directory Certificate Services. In one case an ESC1 template yielded privileged certificates, DCSync, and later exfiltration with renamed Rclone after a privileged identity was excluded from containment. The other used PetitPotam to relay a domain controller’s NTLM authentication to AD CS Web Enrollment (ESC8) and obtain a domain-controller certificate used for PKINIT; that workstation was isolated.

Key facts
  • Case 1 used an ESC1 template for privileged certificates, then DCSync.
  • GBHackers: waves hit 3 then 16 users; certificates for 3 then 8 privileged accounts.
  • Defender blocked over 1,000 SMB attempts; an excluded identity still exfiltrated via Rclone.
  • Case 2 used PetitPotam NTLM relay to ESC8 Web Enrollment; the workstation was isolated.
  • Password resets do not revoke issued certificates; revocation does not kill existing tickets.
  • External onmicrosoft.com tenants and IT-support display names were used.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 30, 2026Microsoft disclosed two AD CS intrusions via Teams lures · Microsoft Security Blog

What each outlet adds

beyond the shared facts
  • Microsoft Security BlogPython, Bun, and Java staging, PKINIT, and containment exclusion.
  • GBHackersUser and certificate counts, SMB blocks, and Rclone renamed SearchApp.exe.
Vendors
Microsoft
Products
Microsoft TeamsActive Directory Certificate ServicesQuick Assist
Malware
PetitPotamRclone

Coverage

oldest first · one row per article · UTC
  1. · 23h ago Microsoft Security BlogFirst report

    Teams help-desk lures led to AD CS ESC1 and ESC8 abuse

    Two unattributed intrusions used Quick Assist; one reached DCSync and exfiltration after a privileged identity was excluded from containment.

  2. · 7h ago GBHackers

    Fake Teams IT help desk sessions abused AD CS for domain access

    Two Microsoft-disclosed intrusions used Quick Assist plus ESC1 or ESC8, then DCSync and Rclone in one case.