Hackers Registered New Teams-Based Domains and Used a Login Page to Steal Your Logins

A newly registered domain copies Microsoft Teams’ login page and interface, raising concerns about a phishing attempt targeting workplace users.

Security researcher Steven Lim reported that teams-cloud[.]live was just five days old when he flagged it on October 18, 2026. He urged organizations to block the address before employees encounter the fake site.

The alert highlights phishing built around a familiar business tool. A copied Teams screen could persuade employees to trust a sign-in request. However, the available report does not establish how many people visited the site, whether passwords were captured, or who operates the domain.

According to Steven Lim, the site mimics both the Teams login screen and its wider user interface. He said it resembles another example he shared on October 8, 2026. That similarity warrants investigation, but it does not confirm that the same attacker controls both sites.

Lim also reported that clicking an option to update Teams downloaded a TXT file. The alert does not provide the file’s contents, a hash, or evidence that it executes code.

Calling it confirmed malware would therefore go beyond the available findings. The unexpected download remains a useful detail for investigators checking browser activity and downloaded files.

Fake Microsoft Teams Domains Used to Steal Credentials

In a pinned comment supplied with the alert, Lim identified amgen[.]teams-cloud[.]live as a healthcare-themed target. The company name appears as a subdomain beneath teams-cloud[.]live. Its presence does not establish that Amgen was breached or that an employee account was accessed.

The concern is the gap between what users see and where they are browsing. A convincing Teams design does not make an unrelated domain a Microsoft service.

Cyber Security News previously covered attackers posing as IT help desk staff through Teams, pushing employees toward downloads or remote access. That separate activity shows how workplace trust can support phishing without a software flaw.

Another report examined fake login pages created through Teams redirects in browsers. No confirmed link exists to this domain, but both cases show why branding alone cannot validate a login prompt.

Defenders should review connections to teams-cloud[.]live and the reported subdomain, then check related downloads and sign-in activity. Lim specifically recommended Tenant blocking and web filtering.

Microsoft documents URL blocking through the Tenant Allow/Block List and custom domain blocking through Defender network protection. Administrators should apply controls suited to their environment and verify coverage rather than assume one setting blocks every route.

Employees should avoid the reported site and verify unexpected Teams update requests through their organization’s established IT support channel before entering passwords or opening downloads.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Registered New Teams-Based Domains and Used a Login Page to Steal Your Logins appeared first on Cyber Security News.