Security firm Check Point Research (CPR) has disclosed a series of four security flaws in Microsoft Teams that allowed attackers to “impersonate executives, manipulate messages, alter notifications, and forge identities in video and audio calls.”
These vulnerabilities, which could be exploited by both external guest users and malicious insiders, represent a fundamental breakdown of identity trust at the user interface (UI) layer. In a remote-work economy, trust in the identity presented by collaboration platforms is absolute. These flaws break that assumption, turning Teams into a potent vector for high-efficacy social engineering.
The “most alarming finding,” according to researchers, was the ability to forge caller identity in audio and video calls. By manipulating a displayName parameter in a JSON payload during call initiation, an attacker could make a call appear to originate from “any chosen name,” such as a CEO or finance department member. This flaw could enable convincing Business Email Compromise (BEC) style fraud, evolved for the video era.
Other vulnerabilities included:
Notification Spoofing (CVE-2024-38197): A flaw in the imdisplayname parameter allowed an attacker to send a message but make the pop-up notification appear to come from a different, trusted source.
Silent Message Editing: Attackers could alter the content of previously sent messages without triggering the standard “Edited” label, undermining the integrity of conversations as a system of record.
Chat Relabeling: An API could be abused in one-on-one chats to mislead a victim about the conversation’s context or participants.
Check Point Research responsibly disclosed the vulnerabilities to Microsoft on March 23, 2024. Microsoft, which initially classified the notification spoofing flaw as medium severity, issued fixes and rolled out patches, with all vulnerabilities reported as resolved by the end of October 2025.
Sources: Check Point Research, The Hacker News, SecurityOnline
—
By Ji-seo Kim
