A newly registered domain has been identified as mimicking Microsoft Teams’ login page, heightening fears of a phishing scheme aimed at workplace users.
Phishing Risks with Microsoft Teams
On October 18, 2026, security researcher Steven Lim discovered a domain named teams-cloud[.]live, which had been active for only five days. He promptly advised organizations to block access to this domain to prevent employees from falling victim to the fraudulent site.
This incident underscores the growing trend of phishing attacks that exploit familiar business platforms. The imitation of the Teams interface could easily mislead employees into providing their credentials. However, the current report does not specify the number of visitors to the site, nor does it confirm any password theft or the identity of the domain operators.
Investigation and Findings
The fake domain replicates not only the Teams login page but also its broader user interface, according to Lim. He noted similarities to another case he disclosed on October 8, 2026, though there is no evidence linking the two incidents to the same perpetrator.
Further investigation revealed that clicking an option to update Teams resulted in the download of a TXT file, though details about the file’s contents or any malicious code were not provided. Without concrete evidence, it is premature to label this as confirmed malware. Nonetheless, the unexpected download is a crucial detail for investigators examining browser activity and file downloads.
Implications for Organizations
Lim also pointed out a related subdomain, amgen[.]teams-cloud[.]live, which appears to target healthcare themes. While the presence of the Amgen name suggests a potential target, there is no proof of a breach or unauthorized account access.
The main concern lies in the disparity between what users perceive and the actual domain they visit. A convincing Teams interface does not equate to a legitimate Microsoft service.
Past reports have highlighted scams where attackers posed as IT support through Teams, urging employees to download files or grant remote access. Such tactics demonstrate how phishing can leverage workplace trust without exploiting software vulnerabilities.
Recommendations for Defense
Organizations should scrutinize connections to teams-cloud[.]live and its subdomain, examining related downloads and sign-in activities. Lim specifically suggested implementing Tenant blocking and web filtering measures.
Microsoft provides documentation on URL blocking using the Tenant Allow/Block List and domain blocking through Defender network protection. Administrators must ensure their security settings are comprehensive rather than relying on a single solution.
Employees should be wary of the reported site and verify any unexpected Teams update requests with their IT support team before entering credentials or downloading files. It is vital to update defenses promptly against emerging threats and integrate threat intelligence feeds from security operations centers.
