Security AlertHigh
Microsoft says attackers abused Teams and AD CS to steal data
Nov 2, 2026 · Summarized by Fundy Tech from The Hacker News
The 30-second version
Attackers posed as IT support on Microsoft Teams, took remote control of PCs, and used weak AD CS settings to get privileged certificates. Microsoft says one intrusion led to data copied to an external server.
Key points
- Microsoft investigated two intrusions using social engineering, not a Teams flaw.
Why it matters
Employees should be cautious about unexpected help-desk messages and remote-access requests. For businesses, weak certificate settings can turn a single compromised workstation into a wider breach.
Who’s affected: Companies using Microsoft Teams and AD CS
What to do
- Train staff to verify help-desk requests.
- Restrict remote tools like Quick Assist.
- Review AD CS templates and certificate settings.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.