---
id: "CMP-202611-gcacwi"
kind: "campaign"
aliases: []
title: "Fake IT support on Microsoft Teams gets remote control via Quick Assist, then abuses misconfigured AD CS (ESC1, ESC8) for domain-admin certificates and steals data (Microsoft)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Teams", "fixed": [], "vendor": "Microsoft"}, {"name": "Active Directory Certificate Services", "fixed": [], "vendor": "Microsoft"}, {"name": "Quick Assist", "fixed": [], "vendor": "Microsoft"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-02T11:41:47+00:00"
updated_at: "2026-11-02T11:41:47+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-02T11:41:47+00:00"}]
---

# Fake IT support on Microsoft Teams gets remote control via Quick Assist, then abuses misconfigured AD CS (ESC1, ESC8) for domain-admin certificates and steals data (Microsoft)

Microsoft reports two intrusions in which attackers messaged and called employees on Microsoft Teams from outside tenants with support-themed names, posing as the company's IT help desk, and talked them into giving remote control through Windows Quick Assist. They then ran scripts with portable Python, Bun or Java runtimes and abused insecure Active Directory Certificate Services: an ESC1 certificate template (requester picks the account) gave certificates for 11 privileged accounts, followed by DCSync on a domain controller. In the other case, PetitPotam coercion plus an NTLM relay to AD CS web enrollment (ESC8) gave a certificate for the domain controller and a Kerberos TGT. In one case data was copied with a renamed Rclone to an outside SFTP server, through a privileged account that had been left out of Defender's automatic attack disruption. These certificates keep working after a password reset or reimaging. No Teams flaw was used. Not tied to any known group. Intrusion dates unknown; reported 2026-11-02.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Microsoft Teams affected ? fixed ?
- :Active Directory Certificate Services affected ? fixed ?
- :Quick Assist affected ? fixed ?

## How to check

Look for Teams chats or calls from external tenants with help-desk or support names followed by Quick Assist sessions. Look for archives unpacked from Downloads into folders named like Windows updates and run with portable python/bun/java. File hashes (SHA-256): 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 (JS), f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 and 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 (Python). In AD CS logs, check for certificates issued for privileged accounts or domain controllers with a requester-supplied subject (ESC1). Also check for NTLM authentication to /certsrv web enrollment (ESC8), DCSync from non-DC hosts, and renamed rclone sending data to external SFTP. Run Defender for Identity ESC1/ESC8 posture checks.

## Fix

Restrict which external Teams tenants can reach staff, and have users confirm support requests through a known internal channel. Block Quick Assist where it is not an approved support tool. Remove enrollee-supplied subject and broad enrollment rights from authentication certificate templates. On AD CS web enrollment, require HTTPS, enable EPA and disable NTLM (KB5005413). EPA is on by default only in Windows Server 2025, so 2019 and 2022 need it set manually. Turn on certificate auditing. If a bad certificate was issued, revoke it and also review or purge Kerberos tickets already issued, because revocation does not cancel them. Make sure no privileged account is left out of automatic containment without a manual response plan.

## Timeline

- 2026-11-02T11:41:47+00:00 analyst

## Documents

- [describes] @TheHackersNews: ⚠️ Attackers impersonated IT support on Microsoft Teams, tricked employees into  https://x.com/TheHackersNews/status/2117212735029313547
- [describes] Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data (The Hacker News, reporting Microsoft) https://thehackernews.com/2026/11/attackers-pose-as-it-support-on.html

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_