Researcher flags new domain teams-cloud.live hosting a fake Microsoft Teams login page
Researcher Steven Lim flagged teams-cloud.live, five days old on 18 October 2026, for copying Microsoft Teams' login screen and interface in an apparent phishing attempt. Microsoft is impersonated; the domain isn't a Microsoft service.
- First reported
- Reports
- 1
Source: cybersecuritynews.com · published
What happened
Cyber Security News reported on 19 October 2026 that security researcher Steven Lim flagged the domain teams-cloud.live, which was five days old when he reported it on 18 October, as copying Microsoft Teams' login screen and wider interface in what appears to be a phishing attempt aimed at workplace users. Lim said clicking an option on the site to update Teams downloaded a TXT file; the report says its contents were not provided and it is not confirmed malware. He also identified a healthcare-themed subdomain, amgen.teams-cloud.live; the report stresses this does not establish that Amgen was breached or that any employee account was accessed. The report also says it is not known how many people visited the site, whether passwords were captured, or who operates the domain. Microsoft is the impersonated brand; teams-cloud.live is not a Microsoft service. Lim recommended tenant blocking and web filtering, and users should verify unexpected Teams update requests with their IT support.
What else the report says
Lim said the site resembles another example he shared on 8 October 2026. Cyber Security News notes that the similarity warrants investigation but does not confirm that the same attacker controls both sites. It also says the TXT file downloaded through the "update Teams" option came with no contents, hash or evidence that it executes code, so calling it confirmed malware would go beyond the available findings; the unexpected download is still a useful detail for investigators checking browser activity and downloaded files.
The report stresses the gap between what users see and where they are browsing: a convincing Teams design does not make an unrelated domain a Microsoft service. It recalls earlier activity in which attackers posed as IT help-desk staff through Teams to push employees toward downloads or remote access.
Defenders are advised to review connections to teams-cloud.live and the reported subdomain, then check related downloads and sign-in activity. Microsoft documents URL blocking through the Tenant Allow/Block List and custom domain blocking through Defender network protection.
Source
Cyber Security News, "Hackers Registered New Teams-Based Domains and Used a Login Page to Steal Your Logins" (19 October 2026).
Red flags
- A Microsoft Teams sign-in page on a domain that isn't microsoft.com or another official Microsoft address.
- A prompt to 'update Teams' from a web page that downloads a file.
- A company name shown as a subdomain of an unfamiliar domain, such as amgen.teams-cloud.live.
- Unexpected links to join or update Teams sent by email or chat.
If you were targeted
- 1Don't enter your password on teams-cloud.live or open files it downloads.
- 2Verify unexpected Teams update requests through your organisation's IT support channel.
- 3If you entered credentials, change your password at once, sign out of other sessions and tell your IT team.
- 4Admins: block the domain in the Tenant Allow/Block List and web filters and review sign-in logs.
- 5Report the page to Microsoft and to your security team.