Lateral movement toward identity infrastructure

Microsoft documents helpdesk impostors riding a granted Teams session to domain controllers

According to Microsoft Threat Intelligence, every stage after the consent prompt runs on software the environment already trusts, which puts the choke point on Teams federation policy and remote-support install rights.