When "IT Support" Is the Attacker

A convincing voice on a Microsoft Teams call is now a viable entry point for full domain compromise. According to reporting from The Hacker News, Microsoft has investigated two intrusions in which attackers impersonated IT support staff on Microsoft Teams, persuaded employees to hand over remote control of their workstations, and then pivoted into Active Directory Certificate Services (AD CS) to mint certificates for privileged accounts — including one for a domain controller. At least one of the two incidents ended with company data being stolen.

The chain is notable less for its novelty than for its efficiency. It combines a low-tech social engineering pretext with a well-documented configuration weakness, skipping the malware-heavy stages that many detection stacks are tuned to catch.

How the Intrusion Unfolded

The reported sequence of events follows a recognizable pattern:

  1. Initial contact. Attackers reached out to employees through Microsoft Teams while posing as the organization's IT support team. Because Teams is a trusted internal collaboration tool, a message or call from an apparent colleague or helpdesk figure carries built-in credibility.
  2. Remote access granted. Under the guise of troubleshooting, the impersonator convinced the employee to allow remote control of their PC. This handed the attacker an interactive foothold on a legitimate, already-authenticated endpoint — no exploit and no malicious attachment required.
  3. AD CS abuse. From that position, the attackers exploited insecure Active Directory Certificate Services configurations to request and obtain authentication certificates for privileged accounts. Certificate-based authentication is trusted by design, which makes a fraudulently issued certificate an attractive persistence and privilege-escalation primitive.
  4. Domain controller access and exfiltration. One of the certificates obtained was for a domain controller. In at least one of the two investigated cases, the intrusion culminated in the theft of company data.

Why AD CS Keeps Appearing in These Stories

Active Directory Certificate Services is a mainstay of enterprise identity, but its default and legacy configurations are frequently permissive in ways administrators do not realize. When certificate templates allow low-privileged users to enroll for certificates that permit client authentication — or when enrollment rights are broadly delegated — an attacker who already holds any foothold can escalate to domain administrator without ever cracking a password.

The appeal for intruders is straightforward: certificate authentication can bypass password-based controls, survive password resets, and blend into normal authentication telemetry. Security researchers have spent years cataloguing these misconfigurations, yet many environments still carry templates that were set up years ago and never reviewed.

The Social Engineering Layer Deserves Equal Attention

The technical half of this chain is fixable with configuration hygiene. The human half is harder. Helpdesk impersonation over chat and voice has become a recurring theme, and the arrival of realistic voice synthesis and AI-assisted conversation makes the pretext more convincing than ever.

Organizations should treat an unsolicited "IT support" request for remote control as a high-risk event regardless of the channel it arrives on. Verification through a known, independent contact path — not a number or link supplied by the requester — is the control that breaks this chain at step two.

Defensive Priorities

  • Audit certificate templates. Review AD CS for templates that permit client authentication or enrollment by unprivileged principals, and remove unnecessary enrollment rights. Treat certificate authority configuration as tier-zero infrastructure.
  • Restrict remote-control tooling. Define who may initiate remote sessions, through which approved tools, and require a second confirmation channel before any session is granted.
  • Harden Teams against impersonation. Apply external access and federation restrictions, enable available protections against impersonation, and train staff that display names and avatars prove nothing.
  • Monitor certificate issuance. Alert on certificate requests and enrollments involving privileged accounts or unusual requesters. A domain controller certificate issued outside normal change windows is a red flag worth investigating immediately.
  • Rehearse the callback. Give employees a simple, sanctioned script: end the interaction and contact the service desk through the published internal channel.

The Takeaway

This campaign is a reminder that identity is the battlefield. A single persuaded employee plus a permissive certificate template can equal domain compromise — and in one of Microsoft's two cases, actual data loss. The fixes are unglamorous but effective: tighten AD CS, constrain remote access, and make verification of IT support requests a reflex rather than an exception.

Organizations that have not reviewed their certificate services configuration recently should treat this report as a prompt to do so.