Attackers Pose as IT Support on Microsoft Teams to Steal Data via AD CS Abuse

In November 2026, Microsoft disclosed an attack pattern in which threat actors posed as IT support personnel on Microsoft Teams to socially engineer employees into granting remote control of their personal or corporate workstations. Once remote access was established, the attackers exploited misconfigurations in the organization's Active Directory Certificate Services (AD CS) infrastructure to fraudulently obtain X.509 login certificates associated with privileged accounts.

According to Microsoft's investigation, the attackers abused insecure AD CS enrollment settings to issue certificates for accounts with elevated permissions, including one instance involving a domain controller certificate. These fraudulent certificates could then be used for authentication to privileged systems, potentially enabling full domain compromise and exfiltration of sensitive company data.

Microsoft stated it investigated two such intrusions. In one confirmed case, data exfiltration occurred. The technique does not exploit a vulnerability in the AD CS software itself but rather takes advantage of overly permissive certificate enrollment policies and lack of proper isolation within the AD CS role.

The attack highlights the risk of combining social engineering with misconfigured PKI infrastructure. Organizations relying on AD CS for authentication are advised to review their certificate enrollment policies, implement stricter issuance controls, and monitor for anomalous certificate requests.