Attackers abuse AD CS to steal credentials via Teams impersonation

Microsoft investigated intrusions where attackers impersonated IT support on Teams to trick employees into granting remote access. Attackers then exploited misconfigured Active Directory Certificate Services to obtain login certificates for privileged accounts, including domain controller access. Organizations should harden AD CS configurations and disable unnecessary certificate templates.