MICROSOFT TEAMS - CREDENTIAL PHISHING

The Teams meeting page was perfect. The domain was four days old.

A researcher published the screenshot on 8 October: a full Microsoft Teams join screen on a domain nobody had rated yet, with Microsoft's own Defender reporting no verdict at all. The page gives you nothing. The address gives you everything.

SB

SafeBrowz Threat Research Security Research · 8 October 2026 · 9 min read

What was actually on the screen

On 8 October 2026 the researcher Steven Lim published a side-by-side screenshot of the page and of Microsoft's own security portal looking at it. It is worth describing carefully, because the detail is the argument.

The left half is the fake. It renders the Teams meeting join screen the way you have seen it a hundred times: the Teams logo, the heading Microsoft Teams meeting, a subtitle reading Meeting with the Design team, an Enter your name field, the audio chooser offering Computer audio and Don't use audio, a camera preview panel captioned Camera is off, a Video effects control, and, at the bottom of the page, a Sign in link sitting next to a Need help? link. The genuine screen offers signing in too, which is the point: everything here is a copy of something real. Nothing is misaligned. Nothing is in the wrong font. There is no spelling mistake to catch.

Notice what the screen does not ask for, either. Nothing on the join screen offers a file to download or a command to copy and paste. That is what separates it from the older fake meeting-link scams, where the copy-paste command was the whole attack. The payoff visible on this screen is the name you type and the sign-in you are nudged to start.

Threat Alert: A newly registered domain, teams-online[.]com, created just 4 days ago, is actively mimicking the full Microsoft Teams login and user interface.

- Steven Lim (@0x534c) October 8, 2026

The address is doing all the work

The URL in the screenshot is the clever part. It reads, in full:

teams-online[.]com/l/meetup-join/19:meeting_MDRhOTg4ZTAtYTcxOC00OGY5LWI2YmYtNjE4N2U0YjQ2ZWY3@thread.v2/0

Everything after the domain is a faithful copy of the shape of a genuine Teams meeting link. Real ones really do look like teams.microsoft.com/l/meetup-join/19:meeting_<long string>@thread.v2/0. The /l/meetup-join/ segment, the 19:meeting_ prefix, the @thread.v2 suffix, all of it is real Teams vocabulary.

And all of it is worthless as evidence, because the path is just text the attacker typed. Anyone can put any path on any domain they own. The only part of a web address that is assigned, paid for and registered is the domain itself, and the domain here is teams-online[.]com.

So the reading habit that works is backwards from the one most people have. Find the first single slash, and look at what sits immediately to its left. That is who you are actually talking to. We made the same point about a chain that opens on a genuine Google address, and the lesson transfers: a familiar word early in a URL is decoration, a registered domain at the end is ownership.

Four days old, and that is the point

The registration record is the second half of the story, and it is public. The domain was created on 4 October 2026 at 19:50 UTC, which matches the "Registered on Oct 4, 2026 7:50 PM" line visible in the researcher's screenshot. The registrar is Global Domain Group LLC and the registrant is hidden behind Super Privacy Service LTD, a privacy proxy. Its nameservers point at Cloudflare.

Four days is not an accident, it is the business model. A phishing domain is typically short-lived, so the operator buys it, uses it hard while it is anonymous, and abandons it before the reports catch up. Every defence that works by asking "what do we already know about this domain" is, by design, asking a question nobody can answer yet.

Why Microsoft Defender had nothing to say

The right half of the screenshot is Microsoft's own threat intelligence page for the domain. Under Detection it reads Threat intelligence verdict: No active verdict, and below that, 0 active alerts, 0 incidents, with High, Medium, Low and Info all at zero. The browser tool the researcher used showed its own badge reading No threat.

This is the sentence worth keeping: no verdict is not a clean verdict. It means the question has not been answered. A blank reputation record on a four-day-old domain is exactly what you would expect, from Microsoft and from anyone else, and reading it as reassurance is the mistake the whole setup is built around.

The researcher's own advice was to stop treating endpoint protection as the last word and add the domain to tenant block lists directly, which is the correct instinct: a reputation system tells you about yesterday's threats, and this one was built the day before yesterday.

Where a link check helps here, and where it does not

Being precise about this matters more than sounding useful, so here is the honest version.

We did not catch this domain on its own merits either. The word "teams" is not a brand keyword in our detection, and it deliberately will not become one: it is an ordinary English word, and a rule matching it would flag real companies like teamsnap.com as impersonators. So on the day it appeared, our layers had no more to say about teams-online[.]com than Defender did. It is on our block list now because it was reported and confirmed, which is the same reputation lag, just on our side of the fence.

What does not need a reputation lookup is the shape of the address, and that is where a checker earns its place: it reads the registrable domain at the end rather than the familiar words at the start, which is the one step people reliably get wrong by eye under time pressure. Our AI layer also reads what a page actually asks for rather than what it resembles, in over 100 languages, which is the part that does not wait for anyone else's verdict.

And the honest limit: if the operator registers the next domain tomorrow, the same gap opens again for a few days. That is not a flaw we can engineer away, it is the arithmetic of new domains. Which is why the habit of reading the end of the address is worth more than any block list, including ours.

Thirty seconds before you type your name

• Find the first single slash and read backwards. A genuine Teams meeting sits on teams.microsoft.com, teams.live.com, or for US government tenants gov.teams.microsoft.us and dod.teams.microsoft.us. What they share is the registered domain at the end, which is Microsoft's. If that part is something else, the rest of the address does not matter.
• Open the meeting from your own side. If it is a real invitation it is in your calendar or your Teams app. Joining from there instead of from the message costs you five seconds and removes the question entirely.
• Ignore the padlock. It certifies encryption, not honesty, and a site registered this morning has one by lunchtime.
• A sign-in link is normal, the domain under it is the question. The genuine Teams join screen carries one too, and some organisations require signing in rather than joining anonymously, so the prompt itself proves nothing. Check whose domain you would be signing in to before you type anything.

If you already entered credentials, change that password from a device you trust and revoke active sessions, then tell your IT team, because a relayed sign-in can survive a password change through the session token. Our recovery guide has the full order of operations.