Hackers use Microsoft Teams messages and calls to gain remote access
Attackers impersonate IT support via Teams to approve Quick Assist sessions and abuse AD CS for privileged account access.
1
Stories per day · 30 days
3 RSS
Relatedmicrosoft-teams3quick-assist3social-engineering3active-directory1dcsync1esc11esc81microsoft1teams1
7 stories, newest first · one card per story
Stories tagged #ad-cs
Attackers pose as IT support on Microsoft Teams to abuse AD CS
Attackers use social engineering via Microsoft Teams and insecure AD CS to steal company data.
Fake Teams IT help desk sessions abused AD CS for domain access
Two Microsoft-disclosed intrusions used Quick Assist plus ESC1 or ESC8, then DCSync and Rclone in one case.
2
Teams help-desk lures led to AD CS ESC1 and ESC8 abuse
Two unattributed intrusions used Quick Assist; one reached DCSync and exfiltration after a privileged identity was excluded from containment.
Top 10 Best Certificate Lifecycle Management (PKI) Tools in 2026 [Ranked & Scored]
A 2026 PKI ranking puts DigiCert first, ahead of Keyfactor and Venafi, citing 47-day TLS lifetimes.
6
CISA Shares 17 Techniques Used by Hackers to Compromise Active Directory
CISA and five international agencies publish joint guidance detailing 17 techniques attackers use to compromise Microsoft Active Directory environments.
2
Privilege escalation from IIS AppPool to NT Authority/SYSTEM
A write-up demonstrates privilege escalation from an IIS AppPool identity to NT AUTHORITY/SYSTEM via the AD CS RPC endpoint.