Identity & AccessFake IT support calls on Teams end with attackers forging domain controller certificates
Microsoft investigators describe two intrusions that started with help desk impersonation and ended with the abuse of Active Directory Certificate Services, including a PetitPotam relay that handed attackers a domain controller's identity.
