# Fake Microsoft Teams Login Page on Newly Registered teams-cloud.live Domain Used for Credential Theft

> Security researcher Steven Lim reported a phishing campaign using newly registered Teams-themed domains that host a fake Microsoft Teams login page and UI to harvest credentials. teams-cloud.live was registered about 5 days before 2026-10-18, and a healthcare-themed subdomain (amgen.teams-cloud.live) was observed. No threat actor attribution is confirmed.

- **Published:** 2026-10-19T11:49:48Z
- **Last reviewed:** 2026-10-19T11:49:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3878
- **ID:** TL-2026-3878
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-18 security researcher Steven Lim reported (via a LinkedIn alert, relayed by Cyber Security News on 2026-10-19) a phishing site hosted on the newly registered domain teams-cloud.live, which was registered roughly five days earlier. The site imitates both the Microsoft Teams sign-in screen and the broader Teams interface in order to capture credentials entered by victims. A subdomain, amgen.teams-cloud.live, was also observed. It uses the name of a healthcare/biotech company as a lure, which suggests per-target or per-sector subdomain theming.

The report states that clicking an option to update Teams on the fake page downloaded a TXT file. The contents of the file were not disclosed, and the source explicitly says there is insufficient evidence to confirm malware execution. This research therefore treats the campaign as credential harvesting, with a possible secondary lure that is unconfirmed.

A similar Teams-themed domain was flagged on 2026-10-08, but the source states there is no confirmed link between the two incidents. The report names no IP addresses, hashes, registrar, hosting provider, or exfiltration endpoints, and no initial delivery vector (email, message, or other) was reported. No threat actor is attributed. A BeaconBeagle domain lookup for teams-cloud.live returned no C2 configuration matches (0 results). Severity is an analyst estimate, not stated in the source.

Recommended defensive actions from the source: block teams-cloud.live through tenant controls and web filtering, review connection logs and download activity for the domain, verify Teams update requests through official IT support channels, apply Microsoft Defender network protection and Tenant Allow/Block List controls, and avoid entering credentials on unexpected login prompts.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1684.001 Impersonation
- T1036 Masquerading
- T1598 Phishing for Information
- T1204 User Execution

## Sources

- [Hackers Registered New Teams-Based Domains and Used a Login Page to Steal Your Logins](https://cybersecuritynews.com/teams-domain-login-page/)
- [Teams-Themed Phishing Campaign Abused Legitimate Microsoft Login Pages (Infosecurity Magazine, context: separate July 2026 Teams-lure campaign)](https://www.infosecurity-magazine.com/news/teams-phishing-abused-legit/)
- [Attackers Are Turning Microsoft's Trusted Login System Into Their Latest Phishing Weapon (Check Point, context: separate Teams-lure campaign)](https://blog.checkpoint.com/email-security/attackers-are-turning-microsofts-trusted-login-system-into-their-latest-phishing-weapon/)
- [Tricky phishing attack targets Microsoft Teams users (Abnormal, context: earlier Teams-notification credential phishing)](https://abnormal.ai/blog/news/tricky-phishing-attack-targets-microsoft-teams-users-heres-how-to-protect-yourself/)
- [Microsoft Defender for Office 365 Tenant Allow/Block List (mitigation referenced by source)](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-about)
- [BeaconBeagle config search for teams-cloud.live (0 results at time of research)](https://beaconbeagle.com/api/v1/configs/search?domain=teams-cloud.live)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3878