A newly uncovered vulnerability in Microsoft Teams has raised alarm bells across the enterprise collaboration world.
Security researchers have demonstrated a way to steal Teams access tokens from Windows machines – potentially giving attackers full, password-free access to users’ chats, emails, and corporate files.
The discovery underscores how attackers are shifting their attention from traditional network perimeters to the authentication tokens that underpin cloud access.
How the Attack Works
The exploit hinges on how the Microsoft Teams desktop client stores authentication tokens locally.
During sign-in, Teams spawns a browser process (using Microsoft’s WebView2 engine) that encrypts session cookies on disk with Windows’ Data Protection API.
But researchers found that the encryption key itself is stored nearby, within Teams’ local cache.
With local access to a compromised device, attackers can extract both the encrypted tokens and the key, decrypt them, and reuse the tokens to impersonate the user.
From there, they can interact with Microsoft’s Graph API – effectively giving them access to Teams messages, Outlook emails, SharePoint files, and more.
While this technique still requires initial endpoint compromise, its stealth makes it particularly dangerous.
Once an attacker has a valid token, their activity appears legitimate to Microsoft’s systems.
That means they can operate quietly, sending internal messages or accessing sensitive data while blending into normal collaboration traffic.
Identity Is the New Perimeter
For IT leaders, this incident is part of a worrying pattern.
Over the past six months, token-based and identity-centric attacks have surged across the Microsoft 365 ecosystem.
Earlier this year, security researchers warned of attackers abusing OAuth tokens to gain persistent access to enterprise cloud environments.
Others exploited flaws in Microsoft Entra ID (formerly Azure AD) to hijack authentication tokens and impersonate users across multiple tenants.
