Researcher flags fake Microsoft Teams update page gwkinvestmicrosoftteams.com pushing an EXE download
@Malwarehunterr reported on 31 October 2026 that gwkinvestmicrosoftteams.com imitates a Teams update, pushes an EXE download and pings Telegram when people visit. Microsoft is not involved; the report is from one X post.
- First reported
- Reports
- 1
Source: x.com · published
What happened
A security researcher posting as @Malwarehunterr on X reported on 31 October 2026 that gwkinvestmicrosoftteams.com is a fake Microsoft Teams meeting page. According to the post, the page displays a spoofed Microsoft Store, automatically downloads an EXE file and tells users to choose “Keep” and “Run anyway”. The post also says the site tracks visitors through Telegram notifications. Microsoft is not involved: the domain is not a Microsoft address. The claims come from the researcher's post and have not been independently verified.
How the scam works
The screenshot attached to the post shows a dark page with a faint video-meeting layout behind a dialog. The dialog carries the Microsoft Teams logo and the message “Microsoft Teams app is required to be updated”, saying an update is needed “to establish a secure audio and video connection for this meeting”, with a spinner and the words “Redirecting to Microsoft Store…”. The visitor is not taken to the real store. Instead, according to the researcher, an installer file starts downloading, and the page coaches the user past the browser's and Windows' warnings by telling them to keep the file and run it anyway.
This is a familiar lure: a meeting invitation with a “required update”. People who expect a Teams call are likely to click through. Browsers flag unusual downloads as unsafe, and Windows may show a SmartScreen warning for unknown programs, so scammers write instructions that tell victims to override the warnings. A file run this way can install malware that steals passwords, browser data or crypto wallets, or gives an attacker remote access, depending on what the payload is. The researcher's post does not say which malware family was delivered.
Microsoft Teams updates itself, and real installers come from Microsoft's own sites and the official store.
Source
@Malwarehunterr on X, post of 31 October 2026 (screenshot). Not independently verified by scammers.com.
Red flags
- A meeting page that says Teams must be updated before you can join, on a domain such as gwkinvestmicrosoftteams.com.
- A page that mimics the Microsoft Store but downloads a file by itself.
- Instructions to choose “Keep” and “Run anyway” after your browser or Windows warns you.
- An executable (.exe) download when you expected to join a call in the browser.
- A meeting link from an unexpected sender or an unfamiliar company name.
If you were targeted
- 1Do not run any file downloaded from gwkinvestmicrosoftteams.com; delete it if you have it.
- 2If you ran it, disconnect from the network, scan with Microsoft Defender or another trusted tool and change passwords from a clean device.
- 3Tell your IT team if it happened on a work computer, and review browser-saved passwords and sessions.
- 4Join Teams meetings through the official app or teams.microsoft.com, and install updates only from official sources.
- 5Never override a browser or Windows warning to run a download you did not expect.