Microsoft Teams Bugs Let Attackers Impersonate Colleagues and Edit Messages Unnoticed

Nov 04, 2025Ravie Lakshmanan

A recent report by cybersecurity researchers has unveiled four security vulnerabilities in Microsoft Teams that could have exposed users to severe impersonation and social engineering attacks.

These flaws allowed attackers to manipulate conversations, impersonate colleagues, and exploit notifications, as stated in a report by Check Point that was shared with The Hacker News.

Microsoft addressed some of these issues in August 2024 under the CVE CVE-2024-38197 after responsible disclosure in March 2024. Subsequent patches were rolled out in September 2024 and October 2025.

The vulnerabilities enabled attackers to modify message content without leaving an “Edited” label, change sender identities, and manipulate notifications to appear as if they were coming from a trusted source, including high-profile executives.

These vulnerabilities pose serious risks to both external guest users and internal malicious actors, allowing them to perform unintended actions such as clicking on malicious links or sharing sensitive data.

Furthermore, the flaws made it possible to change display names in private chat conversations by modifying the conversation topic and alter display names in call notifications, enabling attackers to forge caller identities.

According to Check Point, these vulnerabilities highlight how attackers can exploit trust in collaboration tools, turning platforms like Teams into vectors for deception.

One of the vulnerabilities, CVE-2024-38197, described by Microsoft as a medium-severity spoofing issue affecting Teams for iOS, could allow attackers to alter sender names and trick users into disclosing sensitive information through social engineering tactics.

These findings come at a time when threat actors are exploiting Microsoft Teams for various malicious activities, including persuading targets to grant remote access or run malicious payloads under the guise of support personnel.

Microsoft warned in a recent advisory that the extensive collaboration features of Teams make it a prime target for cybercriminals and state-sponsored actors, with messaging, calls, meetings, and screen-sharing features being weaponized in different stages of an attack.

Oded Vanunu, head of product vulnerability research at Check Point, emphasized the importance of securing trust in collaboration platforms like Teams, stating that organizations must focus on verifying information rather than blindly trusting it.