Microsoft fixes GIF file bug that could be used to hijack Microsoft Teams accounts

Microsoft has reportedly fixed a bug that could have allowed attackers to hijack Microsoft Teams accounts by using a malicious GIF file. Researchers at cybersecurity firm CyberArk revealed that using a subdomain takeover vulnerability in Microsoft Teams, attackers could have used a malicious GIF to scrape user’s data and ultimately take over an organisation’s entire roster of Teams accounts.

Interestingly, to allow access to attackers, all that users would have to do was just a message with a malicious GIF file. “Since users wouldn’t have to share the GIF – just see it – to be impacted, vulnerabilities like this have the ability to spread automatically. This vulnerability would have affected every user who uses the Teams desktop or web browser version,” as per a report by CyberArk.