Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data

At­tac­kers po­sing as IT sup­port on Mi­cro­soft Teams tal­ked em­plo­yees into gi­ving them re­mo­te con­trol of their PCs. They then used in­se­cu­re Ac­ti­ve Di­rec­tory Cer­ti­fi­ca­te Ser­vi­ces (AD CS) set­tings to ob­tain login cer­ti­fi­ca­tes for pri­vi­le­ged ac­counts, in­clu­ding one for a do­main con­tro­ller. Mi­cro­soft said in a re­port that it in­ves­ti­ga­ted two such in­tru­sions, one of which re­sul­ted in com­pany…