Microsoft Teams Bugs

Check Point disclosed flaws in Microsoft Teams that let attackers alter message content and sender metadata (including notifications and display names) to impersonate colleagues, hide edits, and manipulate call notifications. Microsoft patched many issues across 2024–2025 (notably CVE‑2024‑38197 for iOS), but the risks remain relevant for organizations that haven’t fully deployed updates or that rely on guest/external collaboration and hybrid client mixes.

Risk overview

• Impact: Phishing, credential theft, malicious link clicks, unauthorized data disclosure, fraudulent requests appearing to come from trusted colleagues or executives.
• Attack surface: Internal users, guest/external users, unmanaged devices, mobile clients, and hybrid deployments where different client versions coexist.
• Ease of abuse: Moderate — attackers can leverage spoofed UI and notification manipulations to bypass human trust checks even without full account takeover.
• Detection difficulty: High social-engineering value and low technical noise when done carefully (edits hidden, display names spoofed).

Immediate actions (0–72 hours)

1. Patch and update all Teams clients and supporting infrastructure (desktop, web, mobile, admin consoles) to the latest vendor-recommended builds.
2. Block or restrict guest access where not required; review tenant settings for external collaboration and tighten guest policies.
3. Enforce safe messaging behavior: temporarily require explicit verification for any requests involving credentials, MFA resets, financial transactions, or privileged actions.
4. Notify staff with brief guidance: don’t act on requests sent via Teams without out‑of‑band confirmation for sensitive actions; verify via voice call or verified email.
5. Harden admin roles and consent policies: restrict who can configure app integrations, bots, or modify conversation topics that influence display names.

Detection and hunting guidance

• Monitor for:
  • Unexpected edited messages paired with atypical client versions or device types.
  • Administrative or tenant-level changes to Teams conversation metadata, app policies, or display-name related settings.
  • Suspicious invite/guest churn patterns and guest-user activity deviating from baseline.
  • Account behavior anomalies: sudden message activity from low‑privilege accounts that interact with execs, or messages containing links followed by credential or lateral‑movement events.
• Log sources to correlate:
  • Teams audit logs (message edits, policy changes, guest invites), Azure AD sign‑in and conditional access logs, EDR process/network telemetry from endpoints that open links or attachments.
• Alerts to create:
  • Message edit events + admin policy changes within a short window.
  • Guest account posting messages to execs followed by data-exfil or suspicious downloads.

Longer-term mitigations and best practices

• Apply zero-trust verification for requests: require out‑of‑band confirmation before approving sensitive operations initiated over chat.
• Enforce conditional access and modern authentication for all Teams clients; block legacy auth and unmanaged devices.
• Use App Consent and App Permission policies to limit third‑party bots and apps that can post or modify messages.
• Harden endpoint posture: EDR on all devices, web/email link isolation, and safe‑browsing protections for Teams web/desktop clients.
• Educate users about UI spoofing risks: what authentic Teams notifications look like, and clear escalation paths when in doubt.
• Periodically review tenant configuration and run simulated social-engineering tests to validate detection and user behavior.