Hackers Can Access Microsoft Teams Chat and Emails by Retrieving Access Tokens
A newly identified technique enables unauthorized access to Microsoft Teams by extracting encrypted authentication tokens from Windows systems. These tokens can be used to access chats, emails, and SharePoint files.
A newly identified technique enables unauthorized access to Microsoft Teams by extracting encrypted authentication tokens from Windows systems. These tokens can be used to access chats, emails, and SharePoint files.
As detailed in a blog post on Mon, Oct 23, 2025, the tokens are stored in a Chromium-like Cookies database and can be decrypted using Windows' Data Protection API (DPAPI). This method circumvents recent security measures and poses risks for lateral movement and data exfiltration in enterprise environments.
These access tokens allow impersonation capabilities, enabling attackers to send messages or emails on behalf of users, which can be exploited for social engineering or maintaining persistence in a network.
The focus on desktop Office applications, especially Microsoft Teams, highlights vulnerabilities in embedded browser components that handle authentication through login.microsoftonline.com. Microsoft products continue to be significant targets, with recent threats impacting Teams.
Earlier versions of Microsoft Teams stored authentication cookies in plaintext, allowing simple token extraction for use with Graph API and bypassing multi-factor authentication. Updates have transitioned to encrypted formats consistent with Chromium's cookie protection to prevent disk-based theft.
A newly identified technique enables unauthorized access to Microsoft Teams by extracting encrypted authentication tokens from Windows systems.
The current encryption uses AES-256-GCM, secured by DPAPI, a Windows API that ties encryption keys to user or machine contexts. Decryption requires local access and user credentials, making remote attacks more challenging without privilege escalation.
Researchers used SysInternals' ProcMon to identify token locations during the login process. The Cookies database stores critical information such as host keys, cookie identifiers, and encrypted values, all protected by user-specific DPAPI blobs.
Extracting and decrypting these tokens involves using Windows APIs like CryptUnprotectData. Successful decryption uses AES-256-GCM with the extracted key and nonce to access the authentication token.
To protect against these vulnerabilities, it is advisable to monitor for unusual process terminations or patterns and enforce application-specific encryption. Using web-based versions of Teams can also reduce local storage risks.
Organizations should rotate tokens through Entra ID policies and audit API logs for anomalies. As threats to Teams evolve, DPAPI-aware endpoint detection and response (EDR) rules are essential.
Based on reporting by Cyber Security News.