Loading story…
Researchers at Check Point disclosed four critical vulnerabilities in Microsoft Teams that allowed attackers to impersonate executives, alter chat history, and forge notifications or caller identities without detection. These flaws, now patched, enabled manipulation of message content without the usual 'Edited' label, spoofing of alerts to appear from trusted colleagues, and renaming of chats to misrepresent participants. The vulnerabilities exploited Teams' messaging architecture, including the reuse of unique message identifiers and manipulation of hidden conversation parameters, fundamentally undermining the trust in digital communications for over 320 million monthly users.
Microsoft was notified of the issues in March 2024 and addressed them through a series of patches, with the final fix released in October 2025. The vulnerabilities, tracked as CVE-2024-38197 among others, affected both internal users and external guests, posing significant risks of social engineering, data theft, and unauthorized actions. Attackers could trick users into clicking malicious links or sharing sensitive information by making messages and calls appear to originate from high-profile executives or trusted sources, highlighting the importance of prompt patching and ongoing vigilance in collaboration platforms.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In early November 2025, Check Point publicly disclosed four Microsoft Teams vulnerabilities that could let attackers impersonate colleagues or executives, manipulate message content without an 'Edited' label, and spoof notifications or caller identity. The flaws affected scenarios involving external guest users and malicious insiders and raised social-engineering concerns.
An additional patch for the Microsoft Teams flaws was released in October 2025, indicating that remediation continued after the 2024 fixes. The issues included risks such as impersonation, forged identities, and message manipulation.
Microsoft issued further patches for the Teams-related flaws in September 2024, expanding remediation beyond the initial August update. These fixes were part of Microsoft's response to the broader set of spoofing and message-manipulation issues.
Microsoft addressed part of the reported Microsoft Teams impersonation and notification spoofing issues under CVE-2024-38197 in August 2024. The fix covered some of the flaws later described by Check Point.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcehackread.com
Open sourcetechrepublic.com
Open sourcescworld.com
Open sourcego.theregister.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly using **Microsoft Teams** chats to impersonate IT staff or trusted business contacts, persuading employees to approve MFA prompts, click malicious links, or hand over credentials. Palo Alto Networks Unit 42 said the tactic has appeared in multiple intrusions, including **Cloaked Ursa/APT29** activity that used compromised accounts to send malicious Teams messages and **UNC6692** operations that posed as helpdesk personnel to socially engineer targets through the platform. The report said phishing delivered through collaboration tools is rising quickly, with Cortex telemetry showing such activity accounted for **42% of all phishing alerts** in the first four months of 2026, up from **30%** in the prior four-month period. Attackers are exploiting permissive Teams federation settings, unmanaged external accounts, typosquatted domains, and compromised partner tenants to appear legitimate, prompting defenders to tighten external communication controls, restrict federation to approved domains, disable unmanaged external access where possible, strengthen identity protections such as Conditional Access and **Entra Privileged Identity Management**, and monitor for suspicious external chat initiation.
Jun 29, 2026
Microsoft disclosed and patched **CVE-2026-32185**, an **Important** spoofing vulnerability in **Microsoft Teams for Android** caused by improper access to files or directories, mapped to `CWE-552`. The flaw could allow an unauthorized **local attacker** to spoof trusted elements in the app and potentially trick users into accepting malicious content or communications. Microsoft assigned the issue a **CVSS 3.1 score of 5.5** and said exploitation requires local access and user interaction, but could still have a high confidentiality impact. Microsoft said the vulnerability was **not publicly disclosed**, **not exploited in the wild**, and had **no public proof-of-concept** at the time of publication, with exploitation assessed as less likely. The company released a fix through the **Google Play Store** and advised users to update **Microsoft Teams for Android** to version **`1.0.0.2026092103` or later**. Microsoft credited **Ofek Levin of Enclave** with responsibly reporting the issue.
Jun 29, 2026
Attackers used **Microsoft Teams** to impersonate IT or helpdesk staff and socially engineer employees into granting access or executing malicious actions, turning collaboration tooling and trusted support workflows into the initial access vector. One report describes a compromise at an Italy-based consumer services company where a Teams meeting invite and screen sharing session led the victim to run a staged **PowerShell** chain that deployed **PhantomBackdoor**, a multi-stage **WebSocket-based** backdoor associated with earlier spear-phishing activity. The observed sequence included post-call PowerShell execution, device reconnaissance, and establishment of WebSocket command-and-control. A second report describes a similar **vishing** intrusion in which a threat actor posing as support staff called employees through Teams and, after multiple attempts, convinced one user to grant remote access through **Quick Assist**. The attacker then directed the victim to a spoofed credential-harvesting site, used a malicious **MSI** and sideloaded **DLL** to launch follow-on payloads, and established outbound C2. While the malware families and exact post-compromise chains differ, both accounts document the same operational pattern: **Teams-based social engineering**, abuse of legitimate remote assistance or user-guided execution, credential theft or payload staging, and transition to hands-on intrusion activity inside a corporate environment.
Jun 29, 2026