Microsoft says it investigated two attacks in which threat actors posed as internal IT support on Microsoft Teams, persuaded employees to grant remote access to their computers, and then moved deeper into the victim organisations’ environments. In the cases described by Microsoft, the attackers were able to abuse insecure Active Directory Certificate Services (AD CS) configurations to obtain authentication certificates for privileged accounts, including one linked to a domain controller.

The reported activity is notable because it combines a familiar entry method, social engineering of employees, with a more specialised privilege-escalation technique involving certificate-based authentication inside Windows environments. For businesses, that means standard phishing awareness alone may not be enough if identity infrastructure is misconfigured.

What happened

According to Microsoft, the attackers contacted employees on Microsoft Teams while pretending to be IT support staff. After gaining the users’ trust, they convinced them to provide remote control of their PCs. Once inside the environment, the attackers allegedly took advantage of insecure AD CS settings to request certificates that could be used to authenticate as higher-privilege accounts.

Microsoft said it investigated two such intrusions. The source material indicates that at least one case led to company data theft. Microsoft’s report describes the incidents as examples of how attackers can combine human deception with weaknesses in enterprise identity infrastructure.

AD CS is a Windows Server role used to issue digital certificates for authentication, encryption and signing. When it is configured insecurely, certificates can become an alternative path to privileged access, allowing attackers to authenticate in ways that may be less visible than password-based compromise.

Why it matters for European businesses

Many European organisations rely on Microsoft 365 for collaboration while still operating on-premises Active Directory or hybrid identity environments. That combination can create a broad attack surface: employees can be reached through Teams, while legacy or misconfigured certificate services may still be present in internal infrastructure.

This matters beyond large enterprises. Mid-sized businesses often have limited internal security capacity, outsourced IT support models, and older Windows environments that have evolved over time. In such setups, security reviews of AD CS and certificate templates may not have received the same attention as endpoint protection, email security or multi-factor authentication.

The incidents also underline a broader operational risk: attackers no longer need to rely only on email phishing. Collaboration tools such as Teams can be used to make fraudulent contact appear more legitimate, especially when employees expect support interactions through chat.

For regulated organisations, the implications may extend to incident reporting, access-control governance and identity-security controls. Where business-critical systems depend on Active Directory, certificate abuse can become a route to wider compromise of servers, files and administrative accounts.

Who may be affected

• Businesses using Microsoft Teams internally for day-to-day employee communication and support requests.
• Organisations with on-premises Active Directory or hybrid Microsoft environments, especially those running AD CS.
• Companies with outsourced or distributed IT support, where staff may be accustomed to remote support sessions and may find impersonation attempts harder to detect.
• SMEs with legacy Windows infrastructure that has not recently been reviewed for identity and certificate-related misconfigurations.
• Regulated sectors where privileged access to systems and sensitive data creates higher business and compliance risk.

What companies should consider

• Review remote-support procedures. Employees should have clear rules for how legitimate IT support contacts users on Teams or other collaboration platforms, and when remote-control requests are permitted.
• Restrict and verify remote access workflows. Consider requiring formal verification steps before any remote session begins, particularly for admin-related work.
• Assess AD CS exposure. If your organisation runs Active Directory Certificate Services, review certificate templates, enrolment permissions and privilege paths. Misconfigurations in certificate services can create a high-impact route to domain compromise.
• Audit privileged-account protections. Examine whether administrative accounts can be impersonated or authenticated through certificate issuance paths that should not be available.
• Monitor Teams and identity activity together. Security teams should correlate unusual support-style outreach, remote access behaviour, certificate requests and privileged authentication events.
• Update user awareness training. Security guidance should cover impersonation on collaboration platforms, not only email phishing.
• Test incident response readiness. Organisations should be prepared to investigate certificate abuse, revoke compromised certificates and assess broader domain exposure if a workstation is taken over.

While Microsoft’s report refers to two investigated incidents rather than a broad statistical trend, the techniques described are highly relevant for organisations using Microsoft collaboration tools alongside Windows-based identity infrastructure. For European businesses, the practical lesson is clear: collaboration-platform trust, remote-support controls and certificate security need to be reviewed together, not as separate issues.