Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data

Attackers posing as IT support on Microsoft Teams tricked employees into granting remote control of their PCs, then abused insecure Active Directory Certificate Services settings to obtain login certificates for privileged accounts, including one for a domain controller. Microsoft investigated two such intrusions, one of which resulted in company data theft, according to a report.