A newly discovered attack method lets hackers steal Microsoft Teams authentication tokens from Windows systems, allowing full access to private chats, emails, and files.
Quick Summary – TLDR:
- Security researchers found a way to decrypt Teams access tokens stored on Windows devices.
- Attackers can use these tokens to impersonate users and access chats, emails, and SharePoint.
- The method exploits how Teams stores encrypted cookies with weak protections.
- Organizations are urged to tighten endpoint security and monitor Teams activity closely.
What Happened?
Security experts have discovered a severe vulnerability in how Microsoft Teams handles authentication data, revealing that attackers can extract and decrypt access tokens stored on a user’s system. These tokens grant full access to Teams chats, Outlook emails, and SharePoint files, enabling user impersonation and lateral movement across networks without requiring passwords.
The attack relies on weaknesses in the way Microsoft Teams stores encrypted cookies and keys locally. Once attackers gain initial access to a system, they can decrypt the stored tokens, bypassing traditional login and multi-factor authentication (MFA) measures.
Red Team members, have you ever wondered how to extract access tokens from Microsoft Teams?https://t.co/GzRFfyPR5h
— RandoriSec (@RandoriSec) October 23, 2025
Microsoft Teams Tokens at Risk
Researchers, including Brahim El Fikhi, detailed how access tokens can be retrieved from Microsoft Teams desktop apps running on Windows. These tokens are stored within the app’s embedded browser component, msedgewebview2.exe, which writes encrypted cookie data to a local SQLite database.
Although Microsoft improved security after earlier flaws were exposed in 2022 by encrypting the cookie data, the current encryption method still has critical gaps:
- Authentication tokens are encrypted using AES-256-GCM, but the encryption key is protected by Windows DPAPI.
- The DPAPI encryption binds data to the user or machine context but is still decryptable if attackers have local access.
- The actual decryption key is stored in Teams’ local cache, allowing attackers to extract it and unlock the encrypted tokens.
Using common tools like ProcMon from SysInternals, researchers tracked how Teams handles authentication cookies and located the exact paths and keys needed to reverse-engineer the process.
Proof-of-Concept and Exploitation
To demonstrate the risk, researchers built a proof-of-concept tool in Rust that automates the token extraction and decryption process. The tool analyzes the Teams cookies database, decrypts the tokens, and outputs them in usable formats for attackers. A similar tool, GraphSpy, can then ingest these tokens to interact with the Microsoft Graph API, enabling unauthorized access to:
- Teams chats
- Outlook emails
- SharePoint files
- Sending messages as the compromised user
This method allows attackers to masquerade as legitimate employees, making phishing and social engineering attacks much harder to detect. Because all activity originates from a valid account, traditional monitoring tools may fail to flag malicious behavior.
Why This Matters?
Access tokens essentially act as digital keys to Microsoft’s suite of cloud services. Once stolen, these tokens can be reused without needing passwords or MFA, making them especially valuable in targeted attacks against enterprises.
This vulnerability is particularly alarming because:
- It does not rely on any unpatched software.
- It exploits design-level weaknesses in how Teams handles user sessions.
- It allows post-exploitation persistence, enabling long-term network infiltration.
Mitigation and Recommendations
Security teams and IT administrators should take the following steps to reduce risk:
- Implement Endpoint Detection and Response (EDR) tools that can monitor unusual access to Teams configuration files.
- Enforce strict access control over local directories storing authentication data.
- Audit Microsoft Graph API logs for abnormal access patterns or token reuse.
- Rotate access tokens regularly using Entra ID policies.
- Educate users about securing their devices and recognizing phishing attempts.
For end users, it’s important to:
- Keep Windows systems up to date with security patches.
- Use reliable antivirus software.
- Avoid installing unknown applications that could be used for initial access.
SQ Magazine’s Takeaway
Honestly, this is one of those discoveries that should make every IT admin pause. The fact that attackers can sidestep MFA and passwords just by accessing a user’s computer shows how fragile local security still is, even with modern tools like Teams. If your company relies heavily on Microsoft 365, now’s the time to review how you’re protecting those endpoints. I’d recommend shifting more activity to web-based Teams where possible, keeping access tokens out of reach. This attack is clever, practical, and a reminder that encryption alone isn’t enough if the keys are lying around nearby.
