Known malicious kithighphishing

Fake Microsoft Teams meeting: 'You need to update Microsoft Teams' download kit

family: teams-fake-update-kit-2026-10

A copy of the Microsoft Teams pre-join screen on a look-alike domain, at a path shaped like a real meeting link (/l/meetup-join/19:[email protected]/0). The page asks for the visitor's name and sends it to the operator. Links created in the kit's admin panel then switch to a 'You need to update Microsoft Teams' screen, and its Update Teams button downloads a file the operator chose for that link (/api/works/<id>/file). Phones and tablets get an 'Unsupported Device' screen, so only desktop visitors see the lure. A dormant variant of the page instead claims the browser cannot handle the meeting audio and offers a 'Desktop app' download. Seen on teams-online[.]com, registered 2026-10-04.

Anchors

YARA ruleTeams_Fake_Update_Meeting_Kit
SMQL queryrun
contacted_host:teams-online.com OR favicon_hash:1680903877 OR js_sha256:bb9b488a368fba72dac062e7541c7b973b0a2b6ed9bc230a29dea5e78533c6bc OR js_sha256:ed42f032f75c97a2e68677fcd6cd933c45881ff36bcd169e51827ef49284b4a9 OR title:"Microsoft Teams — Update required"

Provenance

Added: 2026-10-08 09:02
One hunt for the kit. Search anchor: pages that contacted teams-online[.]com, carry the kit's favicon or either of its two scripts (app.js, mobile-guard.js), or show the title 'Microsoft Teams — Update required'. Content anchor (a YARA rule, added once it is live): the kit's own structure, meaning its join and update API paths (/api/internal/calling/onlineMeetings/<thread>/joinAttempts, /clientUpdateRequests), the per-link download path and the audio-banner gate, not Microsoft branding, so genuine Teams pages cannot match. Without a per-victim link the download endpoint returns only a placeholder text file, so the file delivered to victims has not been observed.

Sightings (8)

HostScanScriptMatchWhen
teams-online.com0f9e3b95…—query2026-10-08 09:22
teams-online.com0f9e3b95…https://teams-online.com/l/meetup-join/19:meeting_MDRhOTg4ZTAtYTcxOC00OGY5LWI2YmYtNjE4N2U0YjQ2ZWY3@thread.v2/0#htmlyara2026-10-08 09:21
teams-online.comc7c350d7…https://teams-online.com/l/meetup-join/19:meeting_MDRhOTg4ZTAtYTcxOC00OGY5LWI2YmYtNjE4N2U0YjQ2ZWY3@thread.v2/0?errorCode=CLIENT_UPDATE_REQUIRED#htmlyara2026-10-08 09:17
teams-online.com60a3c912…https://teams-online.com/l/meetup-join/19:meeting_MDRhOTg4ZTAtYTcxOC00OGY5LWI2YmYtNjE4N2U0YjQ2ZWY3@thread.v2/0#htmlyara2026-10-08 09:17
𝘁𝗲𝗮𝗺𝘀-𝗼𝗻𝗹𝗶𝗻𝗲.𝗰𝗼𝗺#htmlf604f5a5…https://𝘁𝗲𝗮𝗺𝘀-𝗼𝗻𝗹𝗶𝗻𝗲.𝗰𝗼𝗺#htmlyara2026-10-08 09:17
teams-online.comc7c350d7…—query2026-10-08 09:04
teams-online.com60a3c912…—query2026-10-08 09:04
teams-online.comf604f5a5…—query2026-10-08 09:04