Security Researcher Flags New Fake Microsoft Teams Domain for Credential Theft

Security researcher Steven Lim identified a newly registered domain designed to mimic the Microsoft Teams login experience, raising concerns about a targeted phishing campaign against workplace users. Lim reported the address to the public on October 18, 2026, noting that the domain was only five days old at the time of detection.

According to Cyber Security News, the site at teams-cloud[.]live replicates both the sign-in page and the broader user interface of the legitimate collaboration tool. Lim urged organizations to block this address immediately to prevent employees from entering credentials into the fraudulent site. The report does not confirm how many visitors accessed the page or whether any passwords were successfully stolen by the operators.

Technical Details and Indicators

The alert highlights how attackers leverage familiar business tools to persuade employees to trust malicious sign-in requests. Lim noted that the design closely resembles another example he shared on October 8, 2026. While this similarity warrants further investigation, it does not definitively prove that the same threat actor controls both domains.

Lim also reported that selecting an option to update the application triggered the download of a TXT file. The available report does not provide the file’s contents, a cryptographic hash, or evidence that the file executes malicious code. Therefore, labeling the download as confirmed malware would exceed the current findings.

Targeting and Context

In a pinned comment accompanying the alert, Lim identified amgen[.]teams-cloud[.]live as a healthcare-themed target, using the company name as a subdomain. The presence of this subdomain does not establish that Amgen suffered a breach or that employee accounts were accessed. It demonstrates the gap between what users see and the actual domain they are visiting.

Cyber Security News previously covered separate incidents where attackers posed as IT help desk staff through Teams to push downloads. Another report examined fake login pages created via browser redirects. No confirmed link exists between those activities and this specific domain, but both cases illustrate why branding alone cannot validate a login prompt.

What should you do?

Defenders should review network connections to teams-cloud[.]live and the reported subdomain. Investigators should check for related file downloads and unusual sign-in activity. Lim specifically recommended implementing tenant blocking and enhancing web filtering rules to prevent access to these fraudulent addresses.

What to do and how to stay safe: Microsoft Teams

• Configure web proxies and firewalls to block traffic to teams-cloud[.]live and any associated subdomains.
• Monitor proxy logs and DNS queries for connections to newly registered domains mimicking corporate service names.
• Inspect endpoint download logs for unexpected TXT files or other artifacts linked to suspicious web sessions.
• Educate users to verify the URL in the address bar, ensuring it matches the official corporate domain before entering credentials.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is the domain teams-cloud[.]live officially linked to Microsoft?

No, it is a fraudulent domain created by attackers to mimic the Microsoft Teams interface for phishing purposes.

Was malware confirmed to be downloaded from the site?

No, the report only confirms a TXT file was downloaded; there is no evidence provided that the file contains executable code.

Did the researcher confirm that Amgen was hacked?

No, the presence of an Amgen subdomain does not prove a breach occurred or that any employee accounts were accessed.