Hijacked Microsoft Stream classic domain "spams" SharePoint sites

The legacy microsoftstream.com domain was hijacked on March 27, 2025, causing embedded videos on SharePoint sites that referenced the classic Stream service to display a spam/phishing page imitating Amazon and advertising a Thai online casino. WHOIS records indicate a registrar update on the same date and affected organizations reported intranet pages showing the malicious content; Microsoft briefly took action to block access to the impacted domain. There is no evidence in the report of malware distribution or a larger exploitation campaign, but the incident highlights risks from deprecated service dependencies and unmaintained embedded content.