Image: Google Gemini

Cybercriminals almost had a direct line into the boardroom.

Check Point researchers discovered that Microsoft Teams contained four critical vulnerabilities that allowed attackers to potentially impersonate executives, forge notifications, and manipulate messages. The findings revealed how both external guest users and malicious insiders could exploit these flaws to erode trust.

Researchers stated that the vulnerabilities, “… allow attackers to impersonate executives, manipulate messages, alter notifications, and forge identities in video and audio calls.”

The cost of being everywhere

Microsoft Teams has become a backbone of communication for businesses ranging from startups to global enterprises. Its integration within the Microsoft ecosystem makes it indispensable for many organizations, but that same ubiquity makes it an attractive target.

The vulnerabilities that allow for impersonation or spoofing open the door to social engineering, financial fraud, and even cyber espionage.

Inside the vulnerabilities

The researchers identified four vulnerabilities within Microsoft Teams that could be exploited to manipulate how the platform handles communication and displays user information.

These flaws, if exploited by attackers, could compromise trust between users, enabling malicious actors to impersonate trusted colleagues or executives.

Message manipulation

One critical issue involved message manipulation, where attackers could edit sent messages without triggering the familiar Edited label that usually indicates a change.

This loophole allowed for the subtle alteration of message content after delivery, enabling fraudulent attempts or misinformation to appear legitimate and unaltered.

In practice, such tampering could deceive employees into following instructions or clicking links that come from reliable internal sources.

Notification spoofing

Another vulnerability enabled notification spoofing, allowing malicious users to modify the imdisplayname parameter within Teams’ message payloads.

By doing so, attackers could send notifications that appeared to originate from senior leaders, such as a CEO or finance director.

Because users tend to prioritize and trust messages from authority figures, this manipulation could be used to prompt urgent, fraudulent actions or credential harvesting.

Display name alteration

The team also uncovered a flaw in Teams’ topic API endpoint that allowed alteration of display names in private chat threads.

This weakness allows attackers to rename one-on-one conversations, making them appear as if they were with a different person.

For example, a malicious guest user could rename a chat to appear as if it were a conversation with a company executive or HR representative — creating opportunities for social engineering or information theft within a trusted communication environment.

Forged caller identity

Researchers also identified a forged caller identity vulnerability in Teams’ voice and video calling functionality.

By sending a manipulated JSON payload during the call initiation process, an attacker could falsify the caller’s display name, making it appear as though the call was coming from a different individual.

This exploit could be weaponized during high-stakes or time-sensitive meetings, tricking recipients into engaging with a fraudulent participant or disclosing sensitive information.

Real-world risks behind the flaws

Together, these flaws demonstrate how attackers can exploit trust-based features in collaboration platforms. By subverting familiar user interfaces, they can convincingly impersonate trusted figures, manipulate communications, and potentially compromise sensitive business operations.

The potential impact of these vulnerabilities extends far beyond theory. Attackers could impersonate a CEO to request urgent wire transfers or deliver malware-laden files through messages that appear trustworthy.

Social engineering schemes could be bolstered by notifications that appear to come from legitimate, high-ranking employees.

For example, a threat actor posing as a finance director could send a Teams message instructing an employee to “approve an urgent payment,” leveraging the trust and immediacy that internal communication tools inherently create.

Beyond financial fraud, APT groups could use these vulnerabilities for data exfiltration, misinformation campaigns, or disruption of sensitive communications.

Beyond the patch: building cyber resilience

Check Point reported that Microsoft has patched all of the vulnerabilities as of October 2025.

However, platform-level security is only the first line of defense. Organizations must assume that trusted communication channels can still be subverted.

To strengthen overall cyber resilience, organizations should leverage a multi-layered defense strategy that includes:

• Zero-trust access control: Continuously verify user identities and device health, even for authenticated sessions.
• Advanced threat prevention: Inspect links, files, and payloads within collaboration apps to block malicious content in real time.
• Data loss prevention (DLP): Enforce granular data-sharing controls to prevent unauthorized information exposure.
• User awareness training: Educate employees to verify requests — especially those involving financial or sensitive data — through secondary channels.
• Enhanced logging and monitoring: Implement behavioral analytics and anomaly detection to flag suspicious activity within collaboration tools.
• Segmentation and least privilege: Limit guest access and restrict administrative rights to reduce the potential damage from compromised accounts.

By combining these layered defenses, organizations can reduce the risk of trust-based attacks within collaboration platforms like Microsoft Teams.

Trust is the new attack surface

The Microsoft Teams vulnerabilities highlight a growing reality in enterprise security: as collaboration tools become central to daily operations, trust has become a key target for attackers.

Threat actors increasingly exploit familiar interfaces and human behavior rather than relying solely on technical exploits.

This underscores the need for layered defenses that integrate user awareness, continuous identity validation, and automated threat detection to protect the communication platforms organizations depend on.

Editor’s note: This article first appeared on our sister publication, eSecurityPlanet.com.