Known malicious kitcriticalphishing
Fake Microsoft Teams meeting: 'update required' over a fake Microsoft Store page that downloads Teams_Installer.exe
family: teams-store-update-kit-2026-10
Short link:scanmalware.com/h/329
A fake Microsoft Teams meeting page says the Teams app must be updated, switches to a counterfeit Microsoft Store page and, after a short countdown, downloads Teams_Installer.exe on its own. It then tells the visitor to choose 'Keep' and 'Run anyway' if the browser or Windows warns, and to click Yes / Run. Edge visitors are told the meeting only works in Chrome and the link is copied for them; visitors not on Windows are asked to use a PC. Every step is reported to the operator through a Telegram relay on the same site. The download is a 69 MB unsigned .NET program. Sighted at gwkinvestmicrosoftteams[.]com, registered 2026-10-22.
Anchors
Hunting ruleTeams_Fake_Store_Update_Telegram_Kit
SMQL queryrun
contacted_host:gwkinvestmicrosoftteams.com OR favicon_hash:821688656 OR resource_sha256:c90dbfb630d06f03fbd6ac066a1c9d20f65b42c323beb182631aee9bc13f1fd9 OR download_sha256:c90dbfb630d06f03fbd6ac066a1c9d20f65b42c323beb182631aee9bc13f1fd9Provenance
Added: 2026-10-31 20:21
Matches the page's own structure (its step screens, its Telegram reporting endpoint and its download trigger) wherever it is served, whatever the domain, plus the known host, the page's icon and the installer's SHA-256 (c90dbfb630d06f03fbd6ac066a1c9d20f65b42c323beb182631aee9bc13f1fd9). The download starts about 15 seconds after the page loads, so a quick visit can show only the meeting lobby. Not the same kit as the 'You need to update Microsoft Teams' meeting page on teams-online[.]com.