Phishing Domain Mimics Microsoft Teams Interface to Steal Logins

A newly registered website, teams-online[.]com, is actively mimicking the full Microsoft Teams login page and user interface, raising significant concerns about a phishing campaign designed to steal work account credentials. Security researcher Steven Lim identified the domain, which was only four days old at the time of his analysis on October 8, 2026. At the time of the report, Microsoft Defender reportedly showed zero detections for the site, highlighting a potential gap in immediate security coverage.

The phishing site leverages the familiarity and trust users place in Microsoft Teams, a widely adopted collaboration tool. By replicating the exact login screen and interface, attackers aim to trick employees into entering their email addresses and passwords, thereby exposing sensitive work account information. While the exact method of delivery for this phishing attempt remains unconfirmed, potential vectors include malicious links in emails, chat messages, or even fake meeting invitations.

Microsoft itself has documented instances of phishing attacks utilizing Teams meetings, chats, and calls, underscoring the need for vigilance even within trusted communication platforms. The copied interface of teams-online[.]com is designed to appear legitimate, making it difficult for users to distinguish from the real Microsoft Teams login portal.

Details regarding the technical execution of the phishing attack are limited. The available information describes a credential phishing website rather than a confirmed malware infection. There is no mention of specific malware families, downloaded payloads, or how the submitted login details are collected and processed by the attackers. Furthermore, no victim count or attacker attribution has been provided, and there is no evidence to suggest that the operators have successfully breached Microsoft's systems.

Steven Lim urged organizations to proactively block the domain through tenant block lists and web filtering policies, emphasizing that relying solely on endpoint protection might not be sufficient. The report does not confirm whether the phishing site employs advanced techniques like adversary-in-the-middle (AiTM) phishing, which could potentially capture session tokens and bypass multi-factor authentication (MFA). The reported zero detections by Microsoft Defender also require careful interpretation, as the specific product, scan settings, and testing methodology were not disclosed.

The primary indicator of compromise (IOC) provided for this incident is the domain teams-online[.]com. No IP addresses, file hashes, or additional malicious URLs were supplied. Security teams are advised to use this domain for blocking and investigation purposes, avoiding the inclusion of IOCs from unrelated campaigns. The defanged spelling of the domain in reports is a common practice to prevent accidental clicks and further spread of phishing links.

Organizations are recommended to implement Lim's suggested domain blocks using their existing security controls and to review web access logs for any signs of user interaction with the suspicious domain. In cases of suspected account compromise, a thorough investigation involving unusual sign-ins, newly added authentication methods, and unexpected cloud data access is crucial. Microsoft's guidance for confirmed account compromises includes resetting credentials, revoking active sessions, and removing any attacker-added authentication methods or rules.

To mitigate the risk of such attacks, Microsoft recommends the adoption of phishing-resistant MFA solutions, such as FIDO2 security keys and passkeys. Employees should also be trained to verify unexpected login requests through trusted channels and to always use known company entry points for authentication, rather than relying solely on the visual appearance of a login page.