Fake IT support on Microsoft Teams gets remote control via Quick Assist, then abuses misconfigured AD CS (ESC1, ESC8) for domain-admin certificates and steals data (Microsoft)

Microsoft reports two intrusions in which attackers messaged and called employees on Microsoft Teams from outside tenants with support-themed names, posing as the company's IT help desk, and talked them into giving remote control through Windows Quick Assist. They then ran scripts with portable Python, Bun or Java runtimes and abused insecure Active Directory Certificate Services: an ESC1 certificate template (requester picks the account) gave certificates for 11 privileged accounts, followed by DCSync on a domain controller. In the other case, PetitPotam coercion plus an NTLM relay to AD CS web enrollment (ESC8) gave a certificate for the domain controller and a Kerberos TGT. In one case data was copied with a renamed Rclone to an outside SFTP server, through a privileged account that had been left out of Defender's automatic attack disruption. These certificates keep working after a password reset or reimaging. No Teams flaw was used. Not tied to any known group. Intrusion dates unknown; reported 2026-11-02.

Summary written from the sources below. Check the originals before acting.