Cybersecurity
A new report from Microsoft describes an attack that starts with a familiar-looking message. An employee gets a Teams chat or call from someone who says they’re from the company’s IT department or help desk. The sender’s name sounds legitimate. The request seems routine: “We need to take a quick look at your computer.”
The attackers worked from outside Teams accounts with support-themed names. In both cases Microsoft investigated, they persuaded employees to open Quick Assist, the remote-help tool built into Windows, and read back the connection code. That gave the attacker hands-on control of the workstation.
From one PC to the whole network
Once inside, the attackers went after Active Directory Certificate Services. That’s the part of a Windows network that issues the digital certificates computers and users present when they log in. Where those certificate settings were weak, the attackers were able to issue themselves certificates for highly privileged accounts. In one case they got a certificate for a domain controller, the server that runs logins for the whole network.
A certificate like that keeps working even after the account’s password is reset or the first infected PC is wiped. So the usual cleanup steps don’t end the attacker’s access.
In the first intrusion, Microsoft’s automated defenses blocked most of the activity. But one privileged account had been left out of the automatic response. The attackers used it to reach a file server and copy company data to an outside server. In the second intrusion, the company isolated the affected workstation quickly, and Microsoft reported no further activity.
Why this matters for small and multi-location businesses
Teams didn’t have a software flaw here. Neither did Windows. The attack worked because of trust and configuration: an employee who wanted to be helpful, and network settings nobody had revisited in years. That’s what makes it relevant to growing businesses and franchise brands. Staff at different locations often don’t know their IT contacts personally, so a convincing “help desk” message is easy to believe.
The help-desk impersonation tactic isn’t isolated, either. Security briefings published this week describe similar fake-IT-support campaigns using Teams and phone calls, often as a lead-in to ransomware.
Practical steps to take now
Based on Microsoft’s guidance, here’s what businesses should review:
- Set a verification rule. Staff should confirm any unexpected support request through a known internal channel before sharing their screen or handing over control. A phone number they already have works, and so does an existing ticket.
- Limit outside Teams contact. Restrict which external organizations can message or call your employees on Teams.
- Approve your remote-support tools. Allow only the remote-access tools your IT provider actually uses, and block or limit the rest, including Quick Assist where it isn’t needed.
- Review certificate settings. Have your IT team check Windows certificate templates and web enrollment settings for the known weak configurations Microsoft calls out.
- Close containment gaps. Any account left out of automated security responses should be a deliberate choice with a manual plan behind it, not an oversight.
The takeaway
The best defense here is a simple habit backed by sound configuration. Your team should know exactly how your real IT support will contact them, and your systems should be set up so one convinced employee can’t hand over the keys to the whole network.
If you’re not sure how your Teams settings, remote-access tools, or Windows certificate setup look today, VEXsecure and our Managed IT team can help you review them and put a plan in place. Contact Vexitey to start the conversation.
Sources
- The Hacker News (opens in a new tab), Nov. 2, 2026, summarizing Microsoft’s report
- NetSys Cyber Threat Report, November 2026 (opens in a new tab)
- efex weekly brief (opens in a new tab), week of Nov. 2, 2026