Microsoft says attackers used Teams support lures to steal certificates
Microsoft says attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs and then abused insecure Active Directory Certificate Services settings to obtain login certificates for privileged accounts, including one for a domain controller. In one of two intrusions, the attackers copied company data to an external server, and Microsoft did not link the activity to any known group. What the intrusions…