Phishing domain copies Microsoft Teams login page
in plain words
A new web address was set up to look like the login page for Microsoft Teams, a work chat and meeting app. Security researcher Steven Lim warned that workers could be tricked into typing in their passwords there. He urged organizations to block the address.
Full summary
Security researcher Steven Lim reported that the domain teams-cloud.live was only five days old when he flagged it on October 18, 2026. The site copies the login screen and wider interface of Microsoft Teams, a workplace tool, which raises the risk that employees could trust a fake sign-in request. Lim urged organizations to block the address before staff reach it.
Lim said the site resembles another example he shared on October 8, 2026. He said that similarity warrants investigation but does not confirm that the same operator runs both sites. He also reported that an option to update Teams downloaded a TXT file. The available information does not show the file's contents, a hash, or evidence that it runs code, so the download is not confirmed as malware Harmful software, often spread or controlled using domain names. Full definition of malware.
Lim also identified amgen.teams-cloud.live as a healthcare-themed target, with the company name used as a subdomain A name created under a registered domain, like shop.example.com. Full definition of subdomain beneath teams-cloud.live. The report does not establish that Amgen was breached or that an employee account was accessed. It also does not establish how many people visited the site, whether passwords were captured, or who operates the domain.
Lim recommended tenant blocking and web filtering. Microsoft documents URL blocking through the Tenant Allow/Block List and custom domain blocking through Defender network protection. Administrators are advised to verify coverage rather than assume one setting blocks every route.
Employees should avoid the reported site and confirm unexpected Teams update requests through their organization's established IT support channel before entering passwords or opening downloads.