Microsoft has fixed a subdomain takeover vulnerability in its collaboration platform Microsoft Teams that could have allowed an inside attacker to weaponize a single GIF image and use it to pilfer data from targeted systems. Microsoft neutralized the threat last Monday, updating misconfigured DNS records, after researchers reported the vulnerability on March 23. The attack involves malicious actors being able to abuse a. JSON Web Token ( authtoken ) and a second skype token . The vulnerability can also be sent to groups (a group) which makes it easier for an attacker to get control over users faster and fewer users.
Source: https://threatpost.com/single-malicious-gif-opened-microsoft-teams-to-nasty-attack/155155/