Short answer: Attackers impersonated IT support, used insecure AD CS to steal data. Companies should secure AD CS and disable NTLM. Follow Microsoft’s guidelines for protection.
TL;DR
- Attackers posed as IT support on Microsoft Teams.
- Used insecure AD CS to obtain privileged accounts.
- Copied company data to external servers.
- Microsoft recommends enabling Extended Protection for Authentication and disabling NTLM.
- Test changes in a controlled environment before implementing.
What happened at Microsoft?
This incident involved attackers pretending to be IT support on Microsoft Teams. They tricked employees into giving remote control access to their computers. Using insecure Active Directory Certificate Services (AD CS), the attackers obtained certificates for privileged accounts and copied sensitive data. Companies need to secure AD CS and disable NTLM to prevent such attacks. Microsoft provides detailed steps to protect against these threats.
Key facts
| Reported by | The Hacker News |
|---|---|
| Date reported | 02 Nov 2026 |
How it works
Attackers pretend to be IT support on Microsoft Teams. They get users to share their screens. Then they use a weak Active Directory Certificate Service (AD CS) setting to steal login details.
- Attackers pretend to be IT support
- Use weak AD CS setting
- Steal login details
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-11-02 | Reported by The Hacker News | The Hacker News |
| 2026-11-03 | This Skillmate explainer published | Skillmate |
How to fix it
- If you have an account with the affected company, change that password and any reused copies of it.
- Turn on two-factor authentication (a second login step) wherever the service offers it.
- Expect phishing emails or calls that use the exposed details; verify requests through official channels.
How to detect it
Defenders should look for unusual login attempts, especially if they come from outside the company. Logs might show quick file copies or strange software installations. One false positive could be a new employee signing in from a home network.
Signs to watch for:
- Login alerts from new devices or locations on the affected account.
- Password-reset emails you did not ask for.
- Phishing messages that quote your real account details.
What is confirmed
- Reported by The Hacker News
- Reported by learn.microsoft.com
- Reported by support.microsoft.com
Why it matters
This matters because attackers can steal data and lock out users. Companies must secure their Active Directory settings to prevent such attacks.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What is AD CS and why is it important?
AD CS is Active Directory Certificate Services, which issues certificates for login. It's important because misconfigurations can let attackers steal credentials.
How can attackers use social engineering?
Attackers trick employees by posing as IT support on Microsoft Teams, getting them to share remote control. This allows attackers to install tools and steal data.
What is a certificate in this context?
A certificate is a digital document that lets a user or computer sign in as a specific account, even after the password changes.
How can we prevent these attacks?
Secure AD CS by enabling Extended Protection for Authentication (EPA) and disabling NTLM. Also, limit NTLM authentication where possible.
Related Skillmate posts
Sources
- Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data (The Hacker News)
- Microsoft (primary source) (learn.microsoft.com)
- Microsoft (primary source) (support.microsoft.com)
How we wrote this: facts come from the sources above. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.
