Hijacked – Earlybirds Invest

Microsoft Streams classic domain hijacked

Today, the Microsoft Streams classic domain, microsoftstream.com, was hijacked to display a website imitating Amazon that acts as a phishing page for a Thai online casino, as shown below.

**Microsoftstream.com site showing a spam site**
*Source: Archive.org*

It is unclear if the domain was hijacked or DNS modified to show the news site, but WHOIS records show that a change was made to the domain on March 27, 2025.

Domain Name: MICROSOFTSTREAM.COM Registry Domain ID: 2027086511_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.comlaude.com Registrar URL: http://www.comlaude.com Updated Date: 2025-03-27T02:46:29Z Creation Date: 2016-05-09T22:38:37Z Registry Expiry Date: 2025-05-09T22:38:37Z Registrar: Nom-iq Ltd. dba COM LAUDE Registrar IANA ID: 470 Registrar Abuse Contact Email: abuse@comlaude.com Registrar Abuse Contact Phone: +442074218250 Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited Name Server: NS1-04.AZURE-DNS.COM Name Server: NS2-04.AZURE-DNS.NET Name Server: NS3-04.AZURE-DNS.ORG Name Server: NS4-04.AZURE-DNS.INFO

As a result of the hijack, SharePoint servers that still had embedded videos from the classic microsoftstream.com domain, were now seeing this spam page in pages.

“This afternoon, a user reported a suspicious website on our intranet, that is using microsoftstream.com. After some analysis, it turns out the domain is currently redirecting to a sketchy website signed by ‘Ibiza99’,” reported a SharePoint admin on Reddit.

“Here’s an interesting one for you all. I just got a call that our SharePoint site was showing spam instead of embedded videos. Interesting, I thought. I wonder how that could happen,” another Reddit thread explained.

“So I jumped on to see the issue, site is using embedded video from an aspx page on the SharePoint layout. It is definitely showing spam.”

Earlier today, the domain was shut down again, blocking the spam page from appearing in SharePoint.

“We are aware of these reports and have taken appropriate action to further prevent access to impacted domains,” Microsoft told BleepingComputer when asked about the incident.

However, Microsoft did not share further information about how the domain was hijacked.

Thankfully, the threat actors behind this hijack did not attempt to conduct a more harmful campaign, such as distributing malware through fake software updates or other messages that would have been displayed on SharePoint servers.

Red Report 2025

Based on an analysis of 14M malicious actions, discover the top 10 MITRE ATT&CK techniques behind 93% of attacks and how to defend against them.

Ben Chow, co-founder of Meteora, appears to have had his X account hacked after a post resurfaced concerns about several meme coins.

On March 11, a message was shared from his account, linking his departure from the project to the launch of meme coins, including Libra (LIBRA), Melania Meme (MELANIA), and Official Trump (TRUMP) tokens.

In response, Meteora’s official X account warned that Chow’s account had been compromised and advised users not to engage with the post or any links.

What is a Cryptocurrency: For Beginners (Animated Explainer)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe – We publish new crypto explainer videos every week!

The post accused DefiTuna founders Vlad Pozniakov and Dhirk of prioritizing profit over transparency, claiming they aimed to maximize gains from token launches, including MELANIA, Mates (MATES), and a Raydium-based release.

The message also stated that the meme coin industry was too exploitative for him to continue.

Among the claims in the post were screenshots of conversations between Hayden Davis, CEO of Kelsier Ventures, Gideon Davis, its COO, and Pozniakov. The messages suggested an effort to extract as much value as possible from the MATES token, with one participant reportedly stating, “Yeah, fellas, tbh, we are trying to max extract on this one”.

<br />

Reports later emerged that Meteora’s own account had also been accessed without authorization. Zen, the current CEO of Meteora, confirmed the breach but stated the team had regained control and was verifying security measures.

On February 26, hackers took over Pump.fun’s X account. What was their goal? Read the full story.