Many MindedFake IT chats and stolen app keys, not software bugs, opened company accounts
Three campaigns reported since late October got into company Microsoft accounts without breaking Microsoft's software. In two Microsoft-investigated intrusions, attackers posed as IT support on Teams and talked employees into opening Quick Assist, a built-in Windows remote-help tool, and reading the connection code back to them. In early November, Todyl tracked a single operator who used stolen Entra ID app secrets, the keys software uses to sign in without a person present, to reach 27 organizations, including clients of managed IT providers in energy, government, food and agriculture, transportation and construction, according to Cybersecurity Dive. Huntress reported a mid-October case in which a construction-company employee pasted a sign-in code from a fake Teams meeting-booking page onto Microsoft's real device-login page.
In Microsoft's first case, a weakly set-up certificate template known as ESC1 let the attacker request login certificates for privileged accounts. After a first wave on three user accounts and one workstation produced certificates for three highly privileged accounts, Defender cut those off, except one privileged account left out of automatic response. About 90 minutes later a larger wave hit 16 users and a second workstation, producing certificates for eight more privileged accounts. More than 1,000 later file and logon attempts were blocked, but the attacker still began copying password data and used the excluded account and a renamed copy of Rclone to send files out over SFTP. Microsoft did not say how much left. A second intrusion used a known relay trick to get a certificate for a central login server; after Defender alerts, the customer isolated the workstation and no further activity was observed. Todyl's operator authenticated to at least 33 of 45 targeted app registrations at about 18 organizations, searched 25 tenants, downloaded 81 files and reached about 2,300 mailbox items. Huntress contained the booking case before it spread.
This is friction for security because the door was trust, not a missing patch. When a help-desk chat or a booking page can open a company, access gets tighter and more expensive for everyone. The same pattern touches connection: the tools people use to reach each other are what the attackers borrowed.
Do not trust an unexpected help-desk call or Teams message, and do not share a Quick Assist or device-login code after a surprise invite. Confirm any support request through a known channel. Companies should limit outside Teams tenants, fix certificate templates that let a requester name the account, rotate long-lived app secrets, and close gaps that leave privileged accounts out of automatic lockdown. Microsoft did not say how much data left; Todyl does not know how the secrets were stolen, and its counts are a floor; these were three separate campaigns, not one plot.
Source: Microsoft Security Blog