Workplace collaboration tools have become one of the most reliable disguises for credential phishing, and Microsoft Teams is a frequent target precisely because employees are conditioned to trust its sign-in prompts. A newly discovered lookalike domain is the latest example, copying Teams’ login screen and broader interface closely enough to fool a quick glance.

A Five-Day-Old Domain Built to Deceive

Independent security researcher Steven Lim identified the domain teams-cloud[.]live on October 18, 2026, noting it was only five days old at the time he reported it. New domain registration age is a classic red flag: legitimate enterprise software rarely needs a brand-new domain to serve its login portal, while attackers frequently burn through freshly registered addresses before they get flagged and blocklisted.

Lim’s analysis found that the site doesn’t stop at copying the login box — it replicates the surrounding Teams interface as well, reinforcing the illusion for anyone who lands on the page expecting a familiar product. He also noted the domain bears a resemblance to a separate lookalike he had reported earlier in the month, on October 8, 2026, though it hasn’t been confirmed that the same operator is behind both.

A Healthcare-Themed Subdomain Raises the Stakes

Among the details Lim shared was a specific subdomain, amgen[.]teams-cloud[.]live, which appears to reference the pharmaceutical and biotechnology company Amgen by name. The presence of a company-branded subdomain doesn’t confirm that Amgen’s network or any employee account was actually compromised, but it strongly suggests the campaign — or at least this particular lure — was tailored with a specific organization or sector in mind, rather than cast as a generic, untargeted phishing page.

Attackers increasingly build subdomains that reference a target company’s name specifically because it raises the credibility of the page for an employee who receives a link that already seems to reference their own workplace.

A Suspicious “Update” Button

Beyond the credential-harvesting login page itself, Lim also found that clicking an option prompting users to “update” Teams on the fake site triggers a download of a plain text (.txt) file. The contents of that file, and whether it is designed to execute any code once opened, have not been publicly detailed, so it would be inaccurate to call it confirmed malware at this stage. Even so, an unexpected file download from a sign-in page is a meaningful indicator for defenders reviewing browser history, download logs, or endpoint telemetry, and is worth flagging during any investigation into whether an employee interacted with the site.

How Defenders Should Respond

Lim’s recommendations, echoed by standard Microsoft guidance, center on two complementary controls:

• Tenant-level URL blocking — organizations can add the malicious domain and its subdomains to the Microsoft 365 Tenant Allow/Block List to prevent links from resolving for end users.
• Network-level domain blocking — Microsoft Defender’s network protection features can block outbound connections to the domain at the DNS or firewall layer, providing a second line of defense if a user clicks through anyway.

Security teams should not assume that applying just one of these settings is sufficient; administrators are advised to verify coverage across both the tenant policy and network protection layers, since gaps in either can leave a path open.

What Employees Should Watch For

This incident is a useful reminder that a polished, pixel-perfect interface is not proof of legitimacy. Employees who receive an unexpected prompt to “update” Teams, re-authenticate, or verify their account should resist entering credentials directly and instead confirm the request through their organization’s official IT support channel, rather than any link or number supplied in the message itself. Given that similar Teams-themed lures have already been used to impersonate IT help desks and to redirect victims through malicious browser links, this is unlikely to be the last lookalike domain built around Microsoft’s collaboration platform.