Attackers Use Fake Microsoft Teams Login Pages to Steal Credentials

Key Takeaways

• Phishing campaigns are leveraging deceptive Microsoft Teams login pages to harvest user credentials.
• Attackers are using domains like teams-cloud[.]live, which mimic the legitimate Teams interface.
• A suspicious file download was observed, though its malicious nature is not yet definitively confirmed.
• Organizations should implement tenant blocking, web filtering, and educate employees on verifying login prompts.

Credential Theft via Sophisticated Teams Phishing

Cybersecurity researchers have identified a new phishing campaign employing highly convincing fake Microsoft Teams login pages to trick users into divulging their credentials. This scheme capitalizes on the widespread use of Teams in corporate environments, exploiting user trust in familiar branding.

Security analyst Steven Lim highlighted this activity, pinpointing domains such as teams-cloud[.]live as central to the operation. These domains are meticulously crafted to replicate the authentic Microsoft Teams login experience, making it difficult for unsuspecting users to differentiate between the legitimate service and the malicious imitation.

One specific observation involved a healthcare-themed subdomain, amgen[.]teams-cloud[.]live. While this indicates a potential targeting vector, it does not confirm a breach of Amgen itself or unauthorized access to its employee accounts. The primary concern is the significant discrepancy between the URL displayed in the browser and the authentic Microsoft domain, despite the visual fidelity of the fake login portal.

Suspicious Download Activity Noted

During the analysis, an attempt to update Teams via one of these fake pages initiated the download of a TXT file. Although the contents of this file, its cryptographic hash, or any evidence of executable code have not been provided, its unexpected download is a critical indicator for forensic investigators. While it cannot be definitively categorized as confirmed malware without further analysis, its presence should prompt a thorough review of browser activity and downloaded files on affected systems.

Broader Context of Teams-Related Phishing

This incident is not isolated. Previous reports have detailed various phishing tactics leveraging Microsoft Teams, including attackers impersonating IT help desk personnel to coerce employees into downloading malicious software or granting remote access. Another notable trend involves the creation of fake login pages through browser redirects, though no direct link to the teams-cloud[.]live domain has been established. These cases collectively underscore a persistent challenge: the inherent trust users place in official-looking communications and interfaces, regardless of the underlying URL.

What You Should Do

• Review and Block Domains: Immediately review network connection logs for any activity related to teams-cloud[.]live and its associated subdomains. Implement tenant blocking and web filtering rules to prevent access to these malicious domains.
• Enhance Network Protection: Utilize Microsoft Defender network protection or equivalent solutions to block custom domains identified in phishing campaigns. Verify that these controls are comprehensively applied across your environment.
• Educate Employees: Conduct regular security awareness training emphasizing the importance of verifying URLs before entering credentials, especially for cloud services like Microsoft Teams. Instruct employees to report any suspicious login prompts or unexpected update requests to IT support.
• Verify Updates: Advise employees to always verify requests for software updates through official, established IT support channels rather than clicking links or downloading files from unexpected prompts.
• Monitor Sign-in Activity: Regularly monitor sign-in activity for unusual patterns or failed login attempts that could indicate credential stuffing or brute-force attacks against employee accounts.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.