Known malicious kithighphishing
Fake Microsoft Teams meeting: 'You need to update Microsoft Teams' download kit
family: teams-fake-update-kit-2026-10
A copy of the Microsoft Teams pre-join screen on a look-alike domain, at a path shaped like a real meeting link (/l/meetup-join/19:[email protected]/0). The page asks for the visitor's name and sends it to the operator. Links created in the kit's admin panel then switch to a 'You need to update Microsoft Teams' screen, and its Update Teams button downloads a file the operator chose for that link (/api/works/<id>/file). Phones and tablets get an 'Unsupported Device' screen, so only desktop visitors see the lure. A dormant variant of the page instead claims the browser cannot handle the meeting audio and offers a 'Desktop app' download. Seen on teams-online[.]com, registered 2026-10-04.
Anchors
YARA ruleTeams_Fake_Update_Meeting_Kit
SMQL queryrun
contacted_host:teams-online.com OR favicon_hash:1680903877 OR js_sha256:bb9b488a368fba72dac062e7541c7b973b0a2b6ed9bc230a29dea5e78533c6bc OR js_sha256:ed42f032f75c97a2e68677fcd6cd933c45881ff36bcd169e51827ef49284b4a9 OR title:"Microsoft Teams — Update required"Provenance
Added: 2026-10-08 09:02
One hunt for the kit. Search anchor: pages that contacted teams-online[.]com, carry the kit's favicon or either of its two scripts (app.js, mobile-guard.js), or show the title 'Microsoft Teams — Update required'. Content anchor (a YARA rule, added once it is live): the kit's own structure, meaning its join and update API paths (/api/internal/calling/onlineMeetings/<thread>/joinAttempts, /clientUpdateRequests), the per-link download path and the audio-banner gate, not Microsoft branding, so genuine Teams pages cannot match. Without a per-victim link the download endpoint returns only a placeholder text file, so the file delivered to victims has not been observed.
Sightings (8)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| teams-online.com | 0f9e3b95… | — | query | 2026-10-08 09:22 |
| teams-online.com | 0f9e3b95… | https://teams-online.com/l/meetup-join/19:meeting_MDRhOTg4ZTAtYTcxOC00OGY5LWI2YmYtNjE4N2U0YjQ2ZWY3@thread.v2/0#html | yara | 2026-10-08 09:21 |
| teams-online.com | c7c350d7… | https://teams-online.com/l/meetup-join/19:meeting_MDRhOTg4ZTAtYTcxOC00OGY5LWI2YmYtNjE4N2U0YjQ2ZWY3@thread.v2/0?errorCode=CLIENT_UPDATE_REQUIRED#html | yara | 2026-10-08 09:17 |
| teams-online.com | 60a3c912… | https://teams-online.com/l/meetup-join/19:meeting_MDRhOTg4ZTAtYTcxOC00OGY5LWI2YmYtNjE4N2U0YjQ2ZWY3@thread.v2/0#html | yara | 2026-10-08 09:17 |
| 𝘁𝗲𝗮𝗺𝘀-𝗼𝗻𝗹𝗶𝗻𝗲.𝗰𝗼𝗺#html | f604f5a5… | https://𝘁𝗲𝗮𝗺𝘀-𝗼𝗻𝗹𝗶𝗻𝗲.𝗰𝗼𝗺#html | yara | 2026-10-08 09:17 |
| teams-online.com | c7c350d7… | — | query | 2026-10-08 09:04 |
| teams-online.com | 60a3c912… | — | query | 2026-10-08 09:04 |
| teams-online.com | f604f5a5… | — | query | 2026-10-08 09:04 |