A newly registered site, teams-cloud[.]live, has been flagged for mimicking Microsoft Teams’ login page in a phishing scheme aimed at business users. The domain was first reported on October 18, 2026, just five days after its registration, prompting warnings to block access before employees fall victim. Security researcher Steven Lim highlighted the site’s near-perfect replica of the Teams login screen and interface. However, no proof yet shows how many people have accessed the site, if any credentials were successfully taken, or who is behind it.
How the Scam Works
Users navigating to the site are greeted with a login prompt that looks identical to Microsoft Teams. In one case, a fake “update Teams” link triggers a download of a TXT file during the process. Though unusual, there’s no evidence provided that this file contains malicious code. That said, these kinds of unexpected downloads are red flags for anyone reviewing browser histories or security logs.
Adding to the concern, the domain used a subdomain structured as amgen[.]teams-cloud[.]live, suggesting a healthcare‐oriented impersonation. This does not confirm that the company Amgen was specifically targeted or breached—only that its name was used in the fake URL.
Defending Against the Threat
Blocking access is the first line of defense. Lim encourages organizations to add teams-cloud[.]live and any related domains to tenant allow/block lists and apply filtering at the network level. Microsoft offers tools for custom domain blocking via Defender network protection and tenant controls. However, defenders should verify that the settings in use cover all potential paths attackers might take rather than assume one control blocks everything.
Employees should stay alert for unexpected login pages and downloads, especially when facing a site that impersonates familiar tools like Teams. When in doubt, they should confirm updates or requests through official channels, such as their organization’s IT department, before entering credentials.
This incident underscores a broader trend in phishing attacks where trusted corporate platforms are cloned to trick users. Even without a vulnerability in software, attackers succeed by leveraging brand familiarity and interface mimicry. As phishing techniques evolve, organizations and users must strengthen both technical defenses and awareness training. What to watch for next: whether additional domains using similar tactics emerge, and whether defenders refine controls to catch these impostor login pages before damage is done.
