Security researchers have revealed four vulnerabilities in Microsoft Teams that could have allowed attackers to impersonate colleagues, modify messages, and spoof caller identities — potentially enabling large-scale social engineering attacks.
The Discovery
The flaws were disclosed by Check Point Research, which found that Teams could be manipulated to:
- Edit messages without showing the “Edited” label or the real sender
- Change notification content to make it appear as if messages came from trusted individuals (e.g., executives or IT staff)
- Alter display names in private chats and Teams calls
- Forge caller IDs to impersonate legitimate contacts
These issues affected both internal users and external guests, creating a powerful tool for impersonation-based phishing and deception.
“Together, these vulnerabilities show how attackers can erode the fundamental trust that makes collaboration tools effective,” Check Point said.
Patch Timeline
- 🗓️ March 2024 – Vulnerabilities responsibly disclosed to Microsoft.
- 🧩 August 2024 – Microsoft addresses CVE-2024-38197 (CVSS 6.5).
- 🧰 September 2024 & October 2025 – Additional patches released to strengthen Teams’ message handling and notification integrity.
Potential Impact
Attackers could exploit these flaws to trick users into:
- Clicking malicious links or payloads disguised as trusted messages.
- Sharing sensitive credentials or files during spoofed calls.
- Trusting fake support or executive requests, similar to business email compromise (BEC) attacks.
Expert Perspective
Oded Vanunu, Head of Product Vulnerability Research at Check Point, emphasized that the vulnerabilities strike at the core of digital trust:
“Threat actors don’t need to break in anymore — they just need to bend trust. Seeing isn’t believing anymore, verification is.”
Microsoft’s Response
Microsoft categorized CVE-2024-38197 as a medium-severity spoofing vulnerability affecting Teams for iOS, capable of altering the sender’s display name.
In a broader advisory, Microsoft reiterated that Teams has become a high-value target for both cybercriminals and state actors due to its integration with messaging, meetings, and screen sharing features.
Alcaeus Services Insight
Collaboration platforms like Teams have become as critical — and as exposed — as email.
At Alcaeus Services, we help organizations mitigate these risks by:
- Enforcing Zero Trust communication policies
- Training users to verify requests and sender identities
- Integrating phishing-resistant MFA across Teams and Microsoft 365
💬 In the era of social engineering 2.0, trust is the new attack surface.
