# Lookalike Microsoft Teams domains delivered via search ads, AI search answers and SEO poisoning (no phishing email)

> Three lookalike Microsoft Teams domains (teams-online.com, teams-livemeeting.com, teams-cloud.live) host cloned Teams pre-join pages and are reached through sponsored search ads, an AI-generated search answer and an organic search result rather than phishing email. teams-cloud.live shows a fake 'You need to update Microsoft Teams' prompt that downloads realtek-demo.txt, assessed as a staged lure rather than a confirmed weaponized payload. No actor is named and attribution is unverified.

- **Published:** 2026-11-12T07:17:32Z
- **Last reviewed:** 2026-11-12T07:17:32Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5834
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5834.png
- **ID:** TL-2026-5834
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 9 (3 shown free below)

## Description

Cyble's walkthrough (published 2026-11-12, reconstructed from public artifacts posted by Microsoft Security MVP Steven Lim in October 2026, not a product run) documents three lookalike Microsoft Teams domains. The seed domain teams-online.com was registered on 2026-10-04 behind a privacy service; Lim flagged it on 2026-10-08 and reported zero Microsoft Defender detections at that time. teams-livemeeting.com (about 15 days old at the time of writing, flagged by 3 of 92 vendors) shares the registrar Global Domain Group with teams-online.com. teams-cloud.live (about five days old when flagged on 2026-10-18) ranked second in organic results for the query 'teams cloud live'.

The pages are near-copies of the Teams pre-join screen: a 'Meeting with the Design team' heading, camera preview, audio options, and Sign in / Need help links. Following the join flow on teams-cloud.live leads to a fake 'You need to update Microsoft Teams' prompt whose button downloads realtek-demo.txt. The source judges this file a staged lure, not confirmed malware; its content and hash have not been published. A secondary report states the page also copies the Teams sign-in interface with the aim of collecting work account credentials, and notes a pinned comment citing the subdomain amgen.teams-cloud.live, which does not show that Amgen was targeted or breached.

The notable element is delivery: the lure is reached via sponsored search ads, an AI-generated search answer citing teams-livemeeting.com next to Microsoft's own links, and an organic search ranking. The search ad platform and AI search engine are not named in the source. The source maps the activity to T1583.001 (Acquire Infrastructure: Domains) and T1608.006 (Stage Capabilities: SEO Poisoning). Whether the three domains share one operator is a hypothesis, not a confirmed finding. No CVE, IP address, hash, malware family or actor is stated.

The article also discusses agentic-AI phishing triage (Microsoft's Security Copilot Phishing Triage Agent trial, Cyble's Blaze AI) and prompt-injection tricks aimed at AI email scanners (Barracuda, StrongestLayer, Sublime). Those are context for the evidence-handling guidance and are not part of this campaign.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.008 Malvertising
- T1608.006 SEO Poisoning
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1036.005 Match Legitimate Resource Name or Location
- T1684.001 Impersonation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Web Access to Lookalike Microsoft Teams Domains (teams-online.com / teams-livemeeting.com / teams-cloud.live)** (`TL-2026-5834-SPL-001`)

Detects proxy/web-gateway traffic to the three lookalike Microsoft Teams domains from TL-2026-5834 (including subdomains such as amgen.teams-cloud.live) or to any host matching the teams-<online|livemeeting|cloud|...> lookalike naming pattern. The pages are cloned Teams pre-join screens reached via search ads, AI search answers and SEO poisoning rather than email, so web telemetry is the first place the delivery shows up.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1583.001, T1656, T1204.001
- **Data sources:** proxy, pan:url, zscalernss-web, bluecoat:proxysg:access:syslog
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=proxy sourcetype IN ("pan:url","zscalernss-web","bluecoat:proxysg:access:syslog") earliest=-24h
```TL-2026-5834 lookalike Teams domains: known IOCs plus teams-* naming pattern```
| eval urlhost=mvindex(split(mvindex(split(url,"/"),2),":"),0)
| eval dom=lower(coalesce(url_domain, dest_host, urlhost))
| eval ioc_match=case(match(dom,"(^|[.])(teams-online[.]com|teams-livemeeting[.]com|teams-cloud[.]live)$"),"known_ioc", match(dom,"^(.+[.])?teams-(online|livemeeting|cloud|meeting|live|call|join|portal)[a-z0-9-]*[.](com|live|net|org|app|online|site|xyz|info|cc)$"),"lookalike_pattern")
| where isnotnull(ioc_match)
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(url) as urls values(http_referrer) as referrers values(action) as actions by user src_ip dom ioc_match
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
let LookalikeRegex = @'(^|[.])(teams-online[.]com|teams-livemeeting[.]com|teams-cloud[.]live)$|^(.+[.])?teams-(online|livemeeting|cloud|meeting|live|call|join|portal)[a-z0-9-]*[.](com|live|net|org|app|online|site|xyz|info|cc)$';
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL)
| extend Host = tolower(extract(@'^(?:https?://)?([^/:?#]+)', 1, RequestURL))
| where Host matches regex LookalikeRegex
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Urls = make_set(RequestURL, 20) by SourceUserName, SourceIP, Host, DeviceAction, DeviceVendor
```

### Sigma

```yaml
title: Web Access to Lookalike Microsoft Teams Domains (TL-2026-5834)
id: 7c1f0a52-3b8e-4d61-9a47-2e5d8b9c1f03
status: experimental
description: Detects proxy requests to teams-online.com, teams-livemeeting.com, teams-cloud.live (and subdomains) or to the teams-* lookalike naming pattern, plus requests for the realtek-demo.txt lure file. Pages clone the Microsoft Teams pre-join screen and are reached via search ads, AI answers and SEO poisoning.
references:
    - https://cyble.com/blog/can-agentic-ai-investigate-phishing-campaign/
    - https://pasqualepillitteri.it/en/news/25606/researcher-urges-blocking-teams-cloud-live-fake-microsoft-teams-login
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.resource_development
    - attack.t1583.001
    - attack.defense_evasion
    - attack.t1656
    - attack.execution
    - attack.t1204.002
logsource:
    category: proxy
detection:
    selection_ioc_exact:
        cs-host:
            - 'teams-online.com'
            - 'teams-livemeeting.com'
            - 'teams-cloud.live'
    selection_ioc_sub:
        cs-host|endswith:
            - '.teams-online.com'
            - '.teams-livemeeting.com'
            - '.teams-cloud.live'
    selection_pattern:
        cs-host|re: '^(.+[.])?teams-(online|livemeeting|cloud|meeting|live|call|join|portal)[a-z0-9-]*[.](com|live|net|org|app|online|site|xyz|info|cc)$'
    selection_lure_file:
        c-uri|contains: 'realtek-demo.txt'
    condition: 1 of selection_*
falsepositives:
    - Security researchers or takedown teams visiting the domains
    - Legitimate third-party domains that happen to match the teams-* naming pattern
level: high
```

**Known false positives:**

- Security researchers, SOC analysts or takedown staff visiting the domains during investigation
- Unrelated legitimate sites that happen to match the teams-* naming pattern (e.g. a local sports team site)

**Tuning notes:** Adjust the sourcetype list and url/url_domain/dest_host field names to your proxy add-on. Add vetted legitimate teams-* domains to an allowlist lookup and exclude them in the where clause. The known_ioc match should be high fidelity; consider alerting only on it and sending lookalike_pattern to a hunting queue.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Search-Engine or Ad-Click Referred Visit to Teams Lookalike Domain (locked: unlock with TL Creds)
- Browser Download Originating from Teams Lookalike Domain (MDE) (locked: unlock with TL Creds)
- Lookalike Teams Visit Followed by Sign-In from a New IP (locked: unlock with TL Creds)
- Proxy Access to Teams Lookalike Domains or Lure File Request (Sigma) (locked: unlock with TL Creds)
- Browser Spawned Fake Teams Installer or Update Lure on Endpoint (Sigma) (locked: unlock with TL Creds)
- Teams Brand Subdomain Abuse on Lookalike Domains (e.g. [indicator]) (locked: unlock with TL Creds)
- Fake Teams Update Lure File Written to Endpoint ([indicator]) (locked: unlock with TL Creds)
- DNS Resolution of Teams Lookalike and Community-Related Malvertising Domains (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 9)

Defanged, TLP:CLEAR.

- Domain: `teams-online[.]com`
- Domain: `teams-livemeeting[.]com`
- Domain: `teams-cloud[.]live`

Full set of 9 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Can Agentic AI Investigate a Phishing Campaign? Evidence Walkthrough - Cyble](https://cyble.com/blog/can-agentic-ai-investigate-phishing-campaign/)
- [Researcher urges blocking teams-cloud.live fake Microsoft Teams login](https://pasqualepillitteri.it/en/news/25606/researcher-urges-blocking-teams-cloud-live-fake-microsoft-teams-login)
- [Microsoft RCT on agentic phishing triage (arXiv 2511.13860)](https://arxiv.org/abs/2511.13860)
- [Gartner predicts over 40% of agentic AI projects will be canceled by end of 2027](https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027)
- [Attackers hide AI prompt (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/attackers-hide-ai-prompt/)
- [Scammers text bypass AI email filters (Hackread)](https://hackread.com/scammers-text-bypass-ai-email-filters-phishing-scams/)
- [Malicious email with prompt injection targets AI-based scanners (SC Media)](https://www.scworld.com/news/malicious-email-with-prompt-injection-targets-ai-based-scanners)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5834