Microsoft Teams

Security Advisory

Microsoft Teams Access Token Vulnerability Allows Attack Vector for Data Exfiltration

Summary: Microsoft Teams Access Token Vulnerability: New Attack Vector for Data Exfiltration

A recently uncovered vulnerability in Microsoft Teams for Windows allows attackers with local access to extract encrypted authentication tokens, granting unauthorized access to chats, emails and SharePoint files.

This technique, detailed by researcher Brahim El Fikhi on October 23, 2025, leverages the Windows Data Protection API (DPAPI) to decrypt tokens stored in a Chromium-like Cookies database.

Attackers can use these tokens for impersonation, lateral movement, or social engineering, bypassing recent security enhancements and posing significant risks to enterprise environments.

Vulnerability Details

The vulnerability, identified in Microsoft Teams desktop applications, involves the extraction of encrypted access tokens stored in the SQLite Cookies database at %AppData%\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Cookies. Unlike earlier versions that stored tokens in plaintext (a flaw exposed by Vectra AI in 2022), current versions use AES-256-GCM encryption protected by DPAPI, tied to user or machine credentials. However, attackers with local access can decrypt these tokens using tools like ProcMon and Mimikatz, exploiting the embedded msedgewebview2.exe process that handles authentication via login.microsoftonline.com.

Source: blog.randorisec.fr, cybersecuritynews
Attack Flow

StepDescription
CraftAttackers use ProcMon to monitor msedgewebview2.exe and identify the Cookies database write operations.
AccessThe ms-teams.exe process is terminated to unlock the Cookies file, which is locked during operation.
ExtractThe encrypted token is retrieved from the Cookies database, with fields like host_key (e.g., teams.microsoft.com), name, and encrypted_value (prefixed with “v10”).
DecryptThe DPAPI-protected master key is extracted from %AppData%\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State and decrypted using Windows APIs or tools like Mimikatz.
ExploitDecrypted tokens are used with tools like GraphSpy to access Teams chats, send messages, read emails, or interact with SharePoint via Microsoft Graph API

Why It’s Effective

  • Local Access Exploitation: The attack requires only local access, achievable via malware or compromised endpoints, bypassing MFA and remote defenses.
  • Stealthy Execution: The use of standard Windows APIs (DPAPI) and embedded browser processes evades traditional monitoring.
  • Authority Abuse: Tokens enable impersonation through trusted APIs, amplifying risks of phishing or data theft via Teams, Outlook, or SharePoint.

Recommendations:

  • Monitor Processes – Deploy EDR rules to detect abnormal ms-teams.exe terminations or msedgewebview2.exe file writes.
  • Enforce Encryption – Use app-bound encryption and prefer web-based Teams to avoid local token storage.
  • Token Rotation – Implement Entra ID policies to rotate access tokens regularly and audit Graph API logs for anomalies.
  • Limit Privileges – Restrict local admin access to prevent DPAPI key extraction.
  • User Awareness – Train users to recognize phishing attempts via Teams or email, especially those leveraging impersonation

Conclusion:
This vulnerability underscores the evolving threat landscape for collaboration platforms like Microsoft Teams. As attackers refine techniques to exploit trusted systems, organizations must enhance endpoint monitoring and adopt stricter access controls. By implementing the outlined mitigations, security teams can reduce the risk of token-based attacks and safeguard sensitive data.

References:

Security Advisory

Threat Actors Exploiting Microsoft Teams to Gain Remote Access & Transfer Malware 

Security Advisory:

A new wave of social engineering attacks is exploiting Microsoft Teams, one of the most trusted enterprise collaboration platforms as a malware delivery channel.

Threat actors are impersonating IT support staff to trick employees into installing remote access tools and running malicious PowerShell scripts, enabling full compromise of victim environments. 

This campaign represents an evolution beyond traditional phishing, weaponizing corporate communication channels that employees inherently trust. Once access is established, attackers deploy multifunctional malware loaders such as DarkGate and Matanbuchus, with capabilities for credential theft, persistence, lateral movement and ransomware deployment. 

Technical Summary 

Security researchers have observed financially motivated threat groups abusing Microsoft Teams chats and calls to impersonate IT administrators. Attackers create malicious or compromised Teams accounts often using convincing display names like “IT SUPPORT ” or “Help Desk Specialist” as looking like legitimate and verified account to initiate direct conversations with employees. The social engineering process typically follows this chain 

Attack Process                                                                             Source: permiso.io 

It included the malware features 

  • Credential theft via GUI-based Windows prompts. 
  • Persistence using Scheduled Tasks (e.g. Google LLC Updater) or Registry Run keys. 
  • Encrypted C2 communications with hardcoded AES keys & IVs. 
  • Process protection via RtlSetProcessIsCritical, making malware harder to remove. 
  • Harvesting system info for reconnaissance and follow-on payloads. 

The campaigns have been linked to threat actor groups such as Water Gamayun (aka EncryptHub), known for blending social engineering, custom malware and ransomware operations. 

Element Detail 
Initial Access Direct messages/calls via Microsoft Teams impersonating IT staff 
Social Engineering Fake IT accounts with display names like “IT SUPPORT ✅” and onmicrosoft.com domains 
Malicious Tools QuickAssist, AnyDesk, PowerShell-based loaders (DarkGate, Matanbuchus) 
Persistence Scheduled Tasks (Google LLC Updater), Registry autoruns 
Payload Features Credential theft, system profiling, encrypted C2, remote execution 
Target Enterprise employees, IT professionals, developers 
Objective Credential theft, long-term access, ransomware deployment 

IOCs 

Organizations are urged to block the following indicators immediately: 

Indicator Type 
https://audiorealteak[.]com/payload/build.ps1 URL 
https://cjhsbam[.]com/payload/runner.ps1 URL 
104.21.40[.]219 IPv4 
193.5.65[.]199 IPv4 
Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/7.0.500.0 Safari/534.6 UA 
&9*zS7LY%ZN1thfI Initialization Vector 
123456789012345678901234r0hollah Encryption Key 
62088a7b-ae9f-2333-77a-6e9c921cb48e Mutex 
Help Desk Specialist  User Display Name 
IT SUPPORT User Display Name 
Marco DaSilva IT Support  User Display Name 
IT SUPPORT  User Display Name 
Help Desk User Display Name 
@cybersecurityadm.onmicrosoft.com User Principal Name 
@updateteamis.onmicrosoft.com User Principal Name 
@supportbotit.onmicrosoft.com User Principal Name 
@replysupport.onmicrosoft.com User Principal Name 
@administratoritdep.onmicrosoft.com User Principal Name 
@luxadmln.onmicrosoft.com User Principal Name 
@firewalloverview.onmicrosoft.com User Principal Name 

Remediation: 

  1. Strengthen Microsoft Teams Security 
  • Restrict external tenants and enforce strict access control on Teams. 
  • Implement anomaly detection for suspicious Teams account activity. 
  • Block installation of unauthorized remote access tools (QuickAssist, AnyDesk). 

2. Enhance Endpoint & Network Defenses 

  • Monitor PowerShell execution with EDR/XDR solutions. 
  • Detect persistence artifacts (scheduled tasks, autorun keys, rundll32 activity). 
  • Block known IoCs at DNS/firewall levels. 

 3. Employee Awareness & MFA Security 

  • Train employees to verify IT support requests through independent channels. 
  • Warn staff against installing software via unsolicited Teams messages. 
  • Enforce multi-factor authentication (MFA) for all accounts. 

Conclusion: 
By shifting malware delivery into Microsoft Teams, attackers are exploiting a platform that enterprises inherently trust. The blending of social engineering with technical abuse of PowerShell and remote access tools makes this campaign particularly dangerous, enabling attackers to infiltrate organizations without relying on traditional email phishing. 

Organizations must treat collaboration platforms as high-value attack surfaces not just communication tools. Strengthening monitoring, restricting external interactions and training employees to validate IT requests are critical to defending against this evolving threat.  

References: 

Scroll to top