Hackers Registered New Teams-Based Domains and Used a Login Page to Steal Your Logins
Brief
A newly registered domain copies Microsoft Teams’ login page and interface, raising concerns about a phishing attempt targeting workplace users.
Security researcher Steven Lim reported that teams-cloud[. ]live was just five days old when he flagged it on October 18, 2026. He urged organizations to block the address before employees encounter the fake site.
The alert highlights phishing built around a familiar business tool. A copied Teams screen could persuade employees to trust a sign-in request. However, the available report does not establish how many people visited the site, whether passwords were captured, or who operates the domain.
According to Steven Lim , the site mimics both the Teams login screen and its wider user interface. He said it resembles another example he shared on October 8, 2026.