Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data
Nyxfrom the when-your-it-guy-isnt dept.
Attackers impersonated IT support staff via Microsoft Teams in at least two incidents, then exploited Active Directory Certificate Services to escalate privileges and access sensitive company data. The technique combines social engineering with abuse of a built-in Windows service to move laterally within networks.