Newly Registered Domain Impersonating Microsoft Teams

Several suspicious websites impersonating Microsoft Teams have been flagged for potential phishing activity, raising concerns about Microsoft 365 credential theft and corporate account compromise. These websites mimic legitimate login pages to trick employees into disclosing their credentials, potentially exposing sensitive business information and cloud resources to unauthorised access.

These websites reportedly imitate the appearance of legitimate Microsoft Teams pages to trick users into entering their Microsoft 365 credentials. If stolen, these credentials could allow attackers to access corporate accounts, emails and other business resources.

The reported domains include:

• teams-online[.]com

• teams-livemeeting[.]com

• teamsdpower[.]org

• vinted-teamsupport[.]online

• teamsnapglow[.]org

• teamswins[.]org

Organisations should treat these domains as suspicious and investigate any connections to them. The available information does not confirm a specific threat actor, malware family or number of victims.

Why Is This Threat Dangerous?

A convincing fake login page can deceive employees into believing they are signing in to a legitimate business application. Unlike malware-based attacks, credential phishing can compromise an account without installing malicious software.

Stolen credentials may expose corporate email, confidential files and cloud services. Even websites using HTTPS can be fraudulent, as an encrypted connection does not prove that a website belongs to Microsoft.

Recommended Actions

1. Block Suspicious Domains: Use esentry’s Threat Intelligence services to identify and block confirmed malicious domains across applicable DNS, firewall, web-filtering and endpoint controls.

2. Monitor Network Activity: Leverage esentry’s SOC Monitoring services to investigate connections to suspicious websites and detect potential phishing activity.

3. Investigate Exposed Accounts: Review Microsoft 365 sign-in records and authentication activity for accounts that may have been compromised.

4. Strengthen Email and Web Security: Use esentry’s security assessment services to identify gaps in phishing protection, access controls and security configurations.

5. Improve Employee Awareness: Provide practical security awareness training to help employees recognise fake login pages and suspicious links.

6. Respond Quickly to Incidents: Engage esentry’s incident response support if credentials may have been stolen, ensuring affected accounts are secured and suspicious activity is investigated.

Fake Microsoft Teams login pages demonstrate how attackers can exploit trusted business brands to steal corporate credentials. Organisations should block confirmed malicious domains, investigate suspicious connections and strengthen protection for Microsoft 365 accounts.

With esentry’s cybersecurity services, businesses can improve threat detection, respond to phishing incidents and better protect their users and critical information.

Security reminder: Always verify the website address before entering corporate credentials, even when the login page looks legitimate.