Fake Teams help desk contacts lead to AD CS certificates for privileged accounts
Microsoft described on October 30, 2026 two intrusions in which attackers posing as IT support on Microsoft Teams persuaded employees to open Quick Assist. In the first, an ESC1-vulnerable certificate template let the attacker obtain sign-in certificates for 11 privileged accounts over two waves and run DCSync within seconds; one privileged account excluded from automated response was used to copy file-server data to an external SFTP server. In the second, PetitPotam coercion relayed to AD CS web enrollment (ESC8) yielded a domain controller certificate before the customer isolated the workstation.
- Victim
- Multiple: two organizations investigated by Microsoft (not named)
- Industry
- Cross-industry
- Country
- Global
- Intrusion began
- Not disclosed
- First disclosed
- Oct 30, 2026
- Actor
- Unattributed
- Initial access
- Help desk social engineering
- Identity control that failed
- Directory and trust
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
A certificate template that let the requester name the subject turned one user's workstation into privileged domain access, and a password reset does not revoke an issued certificate. Auditing templates for requester-supplied subjects, enforcing Extended Protection on web enrollment, and keeping no privileged account outside containment are the controls Microsoft names.
Go deeper on SWI
- Technique: Help desk social engineering
- Technique: AD CS certificate template abuse
- SWI coverage: fake teams help desk calls led to ad cs certificates for privileged accounts
Sources
- From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths, Microsoft Security Blog, Oct 30, 2026
Record verified Nov 5, 2026 against the sources above. Corrections: contact us.
Related incidents
- Help desk resets of Okta super administrator MFA at multiple customers 2023 · Help desk social engineering
- Marks & Spencer ransomware attack via impersonation of a third-party user 2025 · Help desk social engineering
- Caesars Entertainment loyalty database theft via IT support vendor 2023 · Help desk social engineering
- MGM Resorts help desk social engineering and ransomware 2023 · Help desk social engineering
Cite this record
SWI Community Team. (2026). Fake Teams help desk contacts lead to AD CS certificates for privileged accounts. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-teams-help-desk-impersonation-adcs-esc1-esc8/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.