Lookalike Microsoft Teams domains delivered via search ads, AI search answers and SEO poisoning (no phishing email)

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5834 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Web Access to Lookalike Microsoft Teams Domains (teams-online.com / teams-livemeeting.com / teams-cloud.live)

Detects proxy/web-gateway traffic to the three lookalike Microsoft Teams domains from TL-2026-5834 (including subdomains such as amgen.teams-cloud.live) or to any host matching the teams-<online|livemeeting|cloud|...> lookalike naming pattern. The pages are cloned Teams pre-join screens reached via search ads, AI search answers and SEO poisoning rather than email, so web telemetry is the first place the delivery shows up.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1583.001, T1656, T1204.001
• Data sources: proxy, pan:url, zscalernss-web, bluecoat:proxysg:access:syslog
• Severity: high
• Confidence: high

Splunk SPL

index=proxy sourcetype IN ("pan:url","zscalernss-web","bluecoat:proxysg:access:syslog") earliest=-24h
```TL-2026-5834 lookalike Teams domains: known IOCs plus teams-* naming pattern```
| eval urlhost=mvindex(split(mvindex(split(url,"/"),2),":"),0)
| eval dom=lower(coalesce(url_domain, dest_host, urlhost))
| eval ioc_match=case(match(dom,"(^|[.])(teams-online[.]com|teams-livemeeting[.]com|teams-cloud[.]live)$"),"known_ioc", match(dom,"^(.+[.])?teams-(online|livemeeting|cloud|meeting|live|call|join|portal)[a-z0-9-]*[.](com|live|net|org|app|online|site|xyz|info|cc)$"),"lookalike_pattern")
| where isnotnull(ioc_match)
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(url) as urls values(http_referrer) as referrers values(action) as actions by user src_ip dom ioc_match
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let LookalikeRegex = @'(^|[.])(teams-online[.]com|teams-livemeeting[.]com|teams-cloud[.]live)$|^(.+[.])?teams-(online|livemeeting|cloud|meeting|live|call|join|portal)[a-z0-9-]*[.](com|live|net|org|app|online|site|xyz|info|cc)$';
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL)
| extend Host = tolower(extract(@'^(?:https?://)?([^/:?#]+)', 1, RequestURL))
| where Host matches regex LookalikeRegex
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Urls = make_set(RequestURL, 20) by SourceUserName, SourceIP, Host, DeviceAction, DeviceVendor

Sigma

title: Web Access to Lookalike Microsoft Teams Domains (TL-2026-5834)
id: 7c1f0a52-3b8e-4d61-9a47-2e5d8b9c1f03
status: experimental
description: Detects proxy requests to teams-online.com, teams-livemeeting.com, teams-cloud.live (and subdomains) or to the teams-* lookalike naming pattern, plus requests for the realtek-demo.txt lure file. Pages clone the Microsoft Teams pre-join screen and are reached via search ads, AI answers and SEO poisoning.
references:
    - https://cyble.com/blog/can-agentic-ai-investigate-phishing-campaign/
    - https://pasqualepillitteri.it/en/news/25606/researcher-urges-blocking-teams-cloud-live-fake-microsoft-teams-login
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.resource_development
    - attack.t1583.001
    - attack.defense_evasion
    - attack.t1656
    - attack.execution
    - attack.t1204.002
logsource:
    category: proxy
detection:
    selection_ioc_exact:
        cs-host:
            - 'teams-online.com'
            - 'teams-livemeeting.com'
            - 'teams-cloud.live'
    selection_ioc_sub:
        cs-host|endswith:
            - '.teams-online.com'
            - '.teams-livemeeting.com'
            - '.teams-cloud.live'
    selection_pattern:
        cs-host|re: '^(.+[.])?teams-(online|livemeeting|cloud|meeting|live|call|join|portal)[a-z0-9-]*[.](com|live|net|org|app|online|site|xyz|info|cc)$'
    selection_lure_file:
        c-uri|contains: 'realtek-demo.txt'
    condition: 1 of selection_*
falsepositives:
    - Security researchers or takedown teams visiting the domains
    - Legitimate third-party domains that happen to match the teams-* naming pattern
level: high

Known false positives:

• Security researchers, SOC analysts or takedown staff visiting the domains during investigation
• Unrelated legitimate sites that happen to match the teams-* naming pattern (e.g. a local sports team site)

Tuning notes: Adjust the sourcetype list and url/url_domain/dest_host field names to your proxy add-on. Add vetted legitimate teams-* domains to an allowlist lookup and exclude them in the where clause. The known_ioc match should be high fidelity; consider alerting only on it and sending lookalike_pattern to a hunting queue.

• 🔒 Search-Engine or Ad-Click Referred Visit to Teams Lookalike Domain · unlock with TL Creds
• 🔒 Browser Download Originating from Teams Lookalike Domain (MDE) · unlock with TL Creds
• 🔒 Lookalike Teams Visit Followed by Sign-In from a New IP · unlock with TL Creds
• 🔒 Proxy Access to Teams Lookalike Domains or Lure File Request (Sigma) · unlock with TL Creds
• 🔒 Browser Spawned Fake Teams Installer or Update Lure on Endpoint (Sigma) · unlock with TL Creds
• 🔒 Teams Brand Subdomain Abuse on Lookalike Domains (e.g. [indicator]) · unlock with TL Creds
• 🔒 Fake Teams Update Lure File Written to Endpoint ([indicator]) · unlock with TL Creds
• 🔒 DNS Resolution of Teams Lookalike and Community-Related Malvertising Domains · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5834.

Sample indicators (3 of 9)

• Domain: teams-online[.]com
• Domain: teams-livemeeting[.]com
• Domain: teams-cloud[.]live

Defanged, TLP:CLEAR. Full set of 9 indicators: unlock with TL Creds.

Community OSINT corroboration

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

No actor is named and attribution is unverified.

Cyble's walkthrough (published 2026-11-12, reconstructed from public artifacts posted by Microsoft Security MVP Steven Lim in October 2026, not a product run) documents three lookalike Microsoft Teams domains. The seed domain teams-online.com was registered on 2026-10-04 behind a privacy service; Lim flagged it on 2026-10-08 and reported zero Microsoft Defender detections at that time. teams-livemeeting.com (about 15 days old at the time of writing, flagged by 3 of 92 vendors) shares the registrar Global Domain Group with teams-online.com. teams-cloud.live (about five days old when flagged on 2026-10-18) ranked second in organic results for the query 'teams cloud live'.

The pages are near-copies of the Teams pre-join screen: a 'Meeting with the Design team' heading, camera preview, audio options, and Sign in / Need help links. Following the join flow on teams-cloud.live leads to a fake 'You need to update Microsoft Teams' prompt whose button downloads realtek-demo.txt. The source judges this file a staged lure, not confirmed malware; its content and hash have not been published. A secondary report states the page also copies the Teams sign-in interface with the aim of collecting work account credentials, and notes a pinned comment citing the subdomain amgen.teams-cloud.live, which does not show that Amgen was targeted or breached.

The notable element is delivery: the lure is reached via sponsored search ads, an AI-generated search answer citing teams-livemeeting.com next to Microsoft's own links, and an organic search ranking. The search ad platform and AI search engine are not named in the source. The source maps the activity to T1583.001 (Acquire Infrastructure: Domains) and T1608.006 (Stage Capabilities: SEO Poisoning). Whether the three domains share one operator is a hypothesis, not a confirmed finding. No CVE, IP address, hash, malware family or actor is stated.

The article also discusses agentic-AI phishing triage (Microsoft's Security Copilot Phishing Triage Agent trial, Cyble's Blaze AI) and prompt-injection tricks aimed at AI email scanners (Barracuda, StrongestLayer, Sublime). Those are context for the evidence-handling guidance and are not part of this campaign.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1684.001 Impersonation

Execution

T1204.001 Malicious Link; T1204.002 Malicious File

Resource Development

T1583.001 Domains; T1583.008 Malvertising; T1608.006 SEO Poisoning

Remediation

Immediate actions

• Block teams-online.com, teams-livemeeting.com and teams-cloud.live (including subdomains) in DNS and web filtering
• Search proxy and DNS logs for user visits to the three domains
• File takedown requests with the registrar (Global Domain Group) and the hosting provider
• Add the teams-* lookalike naming pattern to domain watch lists

Workarounds

• Do not enter credentials or download update files from pages outside Microsoft-owned domains
• Microsoft Teams is updated through the client itself, not through a browser download prompt

Longer-term hardening

• Train users to open Teams from the installed app or the official Microsoft site rather than from search ads or AI answers
• Keep human approval on blocks, takedowns and user notifications when using agentic triage; treat fetched content as data, not instructions
• Monitor newly registered domains containing 'teams' combined with meeting, online, live or cloud terms

Affected and fixed versions

• Microsoft — Microsoft Teams (brand impersonated; no product vulnerability)

Timeline

• 2026-10-04 locked-ioc-3 registered behind a privacy service via registrar Global Domain Group
• 2026-10-08 Steven Lim flags locked-ioc-3 (about four days old) and reports zero Microsoft Defender detections
• 2026-10-13 locked-ioc-4 registered, estimated about five days before it was flagged
• 2026-10-18 Steven Lim flags locked-ioc-4 as a Teams sign-in clone with an update prompt that downloads a text file
• 2026-10-28 locked-ioc-2 registered (estimated from 'about 15 days old' in the 2026-11-12 article); later flagged by 3 of 92 vendors and cited by an AI-generated search answer
• 2026-11-12 Cyble publishes an evidence walkthrough mapping the activity to T1583.001 and T1608.006 and recommending blocking, log hunting and takedowns

Sources cited

• Microsoft RCT on agentic phishing triage (arXiv 2511.13860) arxiv.org · Research · 2025-11-01
• Gartner predicts over 40% of agentic AI projects will be canceled by end of 2027 gartner.com · Research · 2025-06-25
• Can Agentic AI Investigate a Phishing Campaign? Evidence Walkthrough - Cyble cyble.com · Blog · 2026-11-12
• Researcher urges blocking teams-cloud.live fake Microsoft Teams login pasqualepillitteri.it · News · 2026-10-18
• Attackers hide AI prompt (Infosecurity Magazine) infosecurity-magazine.com · News
• Scammers text bypass AI email filters (Hackread) hackread.com · News
• Malicious email with prompt injection targets AI-based scanners (SC Media) scworld.com · News

More in phishing

• 2026 FIFA World Cup Scam Wave: 35,000+ Fake Ticket, Shop and Streaming Sites
• Microsoft Teams Phishing via Fake IT Helpdesk Impersonation (External Tenant Social Engineering)
• Utility Impostor Scams: Lookalike Domains, Scam Ads and Phishing-as-a-Service (Darcula V3) Targeting Utility Customers
• 110-Domain Fake Copyright-Strike (DMCA/YouTube) Phishing Estate Using Browser-in-the-Browser Google Credential Harvesting
• SkyW4lker-Associated Microsoft OAuth Phishing via Adobe-Hosted PDF Lure (slybee.com)