Threat reportPhishingTL-2026-3878
Fake Microsoft Teams Login Page on Newly Registered teams-cloud.live Domain Used for Credential Theft
Fake Microsoft Teams Login Page on Newly Registered (TL-2026-3878) is a medium-severity phishing campaign, first published 2026-10-19. It has no confirmed attribution, affects Microsoft Microsoft Teams / Microsoft 365 accounts (brand, maps to 5 MITRE ATT&CK techniques (T1036, T1204, T1583), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3878
- Threat ID
- TL-2026-3878
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- health, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
How Fake Microsoft Teams Login Page on Newly Registered works
Security researcher Steven Lim reported a phishing campaign using newly registered Teams-themed domains that host a fake Microsoft Teams login page and UI to harvest credentials. teams-cloud.live was registered about 5 days before 2026-10-18, and a healthcare-themed subdomain (amgen.teams-cloud.live) was observed. No threat actor attribution is confirmed.
On 2026-10-18 security researcher Steven Lim reported (via a LinkedIn alert, relayed by Cyber Security News on 2026-10-19) a phishing site hosted on the newly registered domain teams-cloud.live, which was registered roughly five days earlier. The site imitates both the Microsoft Teams sign-in screen and the broader Teams interface in order to capture credentials entered by victims. A subdomain, amgen.teams-cloud.live, was also observed. It uses the name of a healthcare/biotech company as a lure, which suggests per-target or per-sector subdomain theming.
The report states that clicking an option to update Teams on the fake page downloaded a TXT file. The contents of the file were not disclosed, and the source explicitly says there is insufficient evidence to confirm malware execution. This research therefore treats the campaign as credential harvesting, with a possible secondary lure that is unconfirmed.
A similar Teams-themed domain was flagged on 2026-10-08, but the source states there is no confirmed link between the two incidents. The report names no IP addresses, hashes, registrar, hosting provider, or exfiltration endpoints, and no initial delivery vector (email, message, or other) was reported. No threat actor is attributed. A BeaconBeagle domain lookup for teams-cloud.live returned no C2 configuration matches (0 results). Severity is an analyst estimate, not stated in the source.
Recommended defensive actions from the source: block teams-cloud.live through tenant controls and web filtering, review connection logs and download activity for the domain, verify Teams update requests through official IT support channels, apply Microsoft Defender network protection and Tenant Allow/Block List controls, and avoid entering credentials on unexpected login prompts.
MITRE ATT&CK techniques used in TL-2026-3878
Defense Evasion
T1036 Masquerading; T1684.001 Impersonation
Execution
Resource Development
Reconnaissance
Affected products and versions in Fake Microsoft Teams Login Page on Newly Registered
- Microsoft — Microsoft Teams / Microsoft 365 accounts (brand impersonated; no product vulnerability)
Remediation for Fake Microsoft Teams Login Page on Newly Registered
Immediate actions
- Block teams-cloud.live and all subdomains (including amgen.teams-cloud.live) at DNS, proxy and web filtering
- Search proxy, DNS and endpoint logs for connections to teams-cloud.live and for TXT file downloads from it
- Reset credentials and revoke sessions for any user who entered credentials on the site
- Add the domain to the Microsoft Defender for Office 365 Tenant Allow/Block List
Workarounds
- Do not enter credentials on unexpected login prompts; open Teams only through the official app or known URLs
- Do not install Teams updates from links or web prompts
Longer-term hardening
- Enable Microsoft Defender network protection
- Enforce phishing-resistant MFA (FIDO2/passkeys) for Microsoft 365 accounts
- Alert on newly registered domains containing brand strings such as teams, microsoft or office
- Train users to verify Teams update requests through official IT support channels
Timeline of Fake Microsoft Teams Login Page on Newly Registered
- A similar Teams-themed domain was reported; the source states no confirmed connection to the teams-cloud.live incident.
- teams-cloud.live registered, approximately 5 days before 2026-10-18 per the source (exact date not stated).
- Clicking the Teams update option on the fake page downloaded a TXT file of undisclosed contents; malware execution is unconfirmed.
- Researcher Steven Lim reported the fake Microsoft Teams login page and UI on teams-cloud.live and the amgen.teams-cloud.live subdomain.
- BeaconBeagle config search for teams-cloud.live returned no C2 configuration matches.
- Cyber Security News published the report and recommended blocking teams-cloud.live and applying Defender and Tenant Allow/Block List controls.
Sources cited for Fake Microsoft Teams Login Page on Newly Registered
- Hackers Registered New Teams-Based Domains and Used a Login Page to Steal Your Logins
- Teams-Themed Phishing Campaign Abused Legitimate Microsoft Login Pages (Infosecurity Magazine, context: separate July 2026 Teams-lure campaign)
- Attackers Are Turning Microsoft's Trusted Login System Into Their Latest Phishing Weapon (Check Point, context: separate Teams-lure campaign)
- Tricky phishing attack targets Microsoft Teams users (Abnormal, context: earlier Teams-notification credential phishing)
- Microsoft Defender for Office 365 Tenant Allow/Block List (mitigation referenced by source)
- BeaconBeagle config search for teams-cloud.live (0 results at time of research)
Detection coverage for TL-2026-3878
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3878 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.