thehackernews.com
Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data
Microsoft reported two intrusions in which attackers pretended to be IT support on Microsoft Teams and convinced employees to grant control via Windows Quick Assist. After gaining access, the hackers exploited Active Directory Certificate Services (AD CS) templates to issue login certificates for privileged accounts, including a domain controller. One intrusion used an ESC1‑type template that let low‑privilege users request certificates for privileged accounts; another employed the PetitPotam relay technique (ESC8) to obtain a domain‑controller certificate without a [...]