Threat Actors Weaponize Fake Microsoft Teams Domains to Target Users

UNC1069, a DPRK-linked financially motivated threat actor, is operating a social-engineering campaign that uses a fake Microsoft Teams domain (onlivemeet.com) to host convincing meeting pages which prompt victims to download a malicious update (RAT). The actors leverage revived conversations from compromised Telegram and LinkedIn accounts, Slack impersonation, and pre-scheduled meetings via legitimate services like Calendly to increase credibility; defenders are advised to verify destination URLs and treat unexpected meeting/update requests with caution.