Five-day-old domain copies Microsoft Teams login, researcher warns
Original title: Hackers Registered New Teams-Based Domains and Used a Login Page to Steal Your Logins
Steven Lim flagged teams-cloud.live on October 18 and urged blocking; captured passwords and malware are unconfirmed.
Security researcher Steven Lim reported that teams-cloud.live, registered five days earlier, copies the Microsoft Teams login page and interface. He also cited amgen.teams-cloud.live as a healthcare-themed hostname and said an update option downloaded a TXT file whose contents and behavior are unknown. The report does not show how many people visited, whether credentials were stolen, or who runs the domain. Lim recommended tenant blocking and web filtering.
Unconfirmed: Visits, captured passwords, domain operator and whether the TXT download is malware are not established.
- Lim flagged the domain on October 18, 2026, when it was five days old.
- He likened it to a separate example he shared on October 8, without linking the operators.
- The Amgen-themed subdomain does not show that Amgen was breached.
- Microsoft documents URL blocking via the Tenant Allow/Block List and Defender network protection.
Impact: Possible theft of workplace login credentials
- 1.Block teams-cloud.live and review connections, downloads and sign-ins.
- 2.Verify unexpected Teams update prompts with internal IT before entering passwords.
- Vendors
- Microsoft
- Products
- Microsoft Teams
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | amgen.teams-cloud.live | In a pinned comment supplied with the alert, Lim identified amgen[.]teams-cloud[.]live as a healthcare-themed target. The company name appears |
| domain | teams-cloud.live | rkplace users. Security researcher Steven Lim reported that teams-cloud[.]live was just five days old when he flagged it on October 18, |
From the original article
2 min read at cybersecuritynews.com
A newly registered domain copies Microsoft Teams’ login page and interface, raising concerns about a phishing attempt targeting workplace users. Security researcher Steven Lim reported that teams-cloud[.] live was just five days old when he flagged it on October 18, 2026.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.