Back Gbhackers

Threat Actors Weaponize Fake Microsoft Teams Domains to Target Users

Gbhackers •Divya • April 6, 2026

Threat actors associated with North Korea are deploying fake Microsoft Teams domains to conduct social engineering attacks and distribute malware. The threat group, identified as UNC1069, uses convincing meeting lures and compromised communication channels to target unsuspecting professionals. UNC1069 is a financially motivated threat actor linked to the Democratic People’s Republic of Korea (DPRK). On […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean Hackers Exploit Fake Microsoft Teams Domains for Malware Attacks Threat actors linked to North Korea, identified as UNC1069, are using fake Microsoft Teams domains to execute social engineering attacks and distribute malware. These attacks target corporate users by mimicking the widely used communication platform, tricking them into downloading malicious payloads. The threat group employs convincing meeting invitations and compromised communication channels to lure unsuspecting professionals. As Microsoft Teams is integral to remote work, the scope of impact is significant, affecting numerous organizations that rely on this tool. The attacks are financially motivated, and the current status indicates ongoing campaigns against users. Specific details on the number of affected users or systems have not been disclosed. 4 sources 73

Extracted Entities

Threat Actors Weaponize Fake Microsoft Teams Domains to Target Users

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

Tools (1)