Microsoft Threat Intelligence published an investigation of two human-operated intrusions on 30 October 2026 (US time). In both, threat actors used Microsoft Teams messages and calls to impersonate IT or help desk personnel and socially engineered users into granting interactive remote access, primarily through Quick Assist, using organisation-themed onmicrosoft.com tenant names and support-oriented display names. During the remote session they placed an archive in the user's Downloads folder, extracted it into a KB-prefixed staging directory under the user profile and ran the payload with a portable Python, Bun (JavaScript) or Java runtime, then ran host and network discovery and assessed Active Directory Certificate Services (AD CS).

In Case 1 the attacker abused an ESC1-vulnerable certificate template to obtain certificates for three highly privileged accounts, then, after a second Teams-phishing wave targeting 16 users about 90 minutes later, for eight more, and performed DCSync within seconds of obtaining one privileged certificate. Microsoft Defender attack disruption restricted the covered identities and blocked more than 1,000 subsequent SMB file-access attempts, but one privileged account excluded from automated response stayed usable and was later used to reach a file server and copy data to an external SFTP destination with a renamed copy of Rclone (SearchApp.exe).

In Case 2 the attacker used PetitPotam to make the domain controller authenticate to an attacker-controlled system, relayed that NTLM authentication to AD CS Web Enrollment (ESC8), obtained a certificate using the Domain Controller template and used it for Kerberos PKINIT to get a ticket-granting ticket for the domain controller; after Defender ESC8-related alerts the customer isolated the workstation and no further progression was observed.

Microsoft says the activity did not exploit a vulnerability in Microsoft Teams but relied on social engineering and insecure or overly permissive AD CS configurations, that resetting the user's password or reimaging the first workstation does not revoke an issued certificate or invalidate Kerberos tickets already issued, and that the activity is not attributed to a specific threat actor. (source: Microsoft Security Blog)