It called it "Spark Copilot", and it works similarly to the real thing.
Attackers posing as internal IT staff on Microsoft Teams convinced employees to share remote access, then exploited misconfigured Active Directory Certificate Services to steal privileged login ...