Follow us on Google News
Microsoft has warned of an active phishing campaign targeting Microsoft 365 users following the widespread service outage that disrupted Outlook, Teams and other workplace applications earlier this week. Cybercriminals are using fraudulent service notifications to persuade recipients to click malicious links by falsely claiming that their emails could be permanently deleted.
Microsoft Threat Intelligence disclosed on Saturday that the fraudulent messages impersonate official service-health communications and reference the genuine Exchange Online incident identified as EX1550543.
The campaign has targeted organisations across multiple industries in the United States. While the activity appears designed to steal account credentials, Microsoft has not confirmed whether the attackers have successfully obtained passwords or delivered malicious software.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Fake Outage Notifications Threaten Users With Email Deletion
The phishing campaign exploits the uncertainty created by the November 12 Microsoft 365 service disruption, which left businesses and individuals facing difficulties accessing workplace applications and receiving emails.
Microsoft identified fraudulent messages on November 13 that claimed certain emails had been held back during the outage. Recipients were warned that these messages would be deleted within 24 hours unless they clicked a link to restore them.
The attackers attempted to make their communications appear credible by including the actual incident reference number associated with the Exchange Online disruption.
Microsoft said the fraudulent emails used subject lines beginning with the word “Outage”, followed by a six-character code.
Sender display names also incorporated organisation-specific identifiers alongside terms such as “Outage Notification” and “Service Health”.
These details could make the messages appear to originate from an employer’s information technology department or an authorised Microsoft service administrator.
The threat of losing important business communications creates additional pressure on recipients to respond quickly without independently verifying the message.
However, Microsoft’s warning makes clear that the purported 24-hour deletion deadline is part of the fraudulent campaign, not a genuine instruction associated with the service outage.
Attackers Use Tracking Links To Redirect Users To Suspicious Websites
Microsoft identified three sender domains associated with the campaign: moments-notice[.]com, planetmaison[.]com and newbooker[.]com.
The fraudulent messages contained individualised links using SendGrid, a legitimate email delivery and marketing platform.
When recipients clicked these links, they were redirected to a separate domain identified as reallifeaccounting[.]com.
The use of legitimate email infrastructure can make phishing messages more difficult to identify through basic security checks. However, the presence of a familiar email service or tracking link does not establish that the message itself is trustworthy.
Microsoft described the campaign as consistent with credential phishing, a form of cyber fraud in which attackers attempt to obtain sensitive account information by impersonating trusted organisations.
In a typical credential-phishing operation, users may be directed towards a fraudulent sign-in page designed to collect usernames, passwords or other authentication information.
If attackers obtain access to a workplace email account, they may subsequently attempt to steal confidential documents, impersonate employees or send further fraudulent messages to colleagues and business partners.
However, Microsoft has not established that the links in this particular campaign successfully collected credentials or installed malware.
The company has also not disclosed the identity of the attackers or the number of organisations that received the fraudulent emails.
Genuine Microsoft Outage Creates Opportunity For Social Engineering
The campaign follows a prolonged Microsoft 365 outage that affected Outlook, Teams, Copilot and several other services.
As previously reported by The420.in, the disruption also affected Microsoft 365 connections used by artificial intelligence platforms, including OpenAI and Anthropic.
Microsoft subsequently attributed the incident to a technical problem involving changes to its network infrastructure and clarified that the original outage was not caused by malicious activity.
The phishing campaign is therefore a separate security threat that emerged as criminals attempted to exploit the consequences of the genuine technical failure.
Such tactics are commonly associated with social engineering, where attackers manipulate individuals into taking actions that compromise their security.
Rather than relying exclusively on technical vulnerabilities, criminals exploit circumstances that make their requests appear believable.
A major service outage provides a particularly useful opportunity because affected users may already be expecting recovery instructions, password resets or notifications from their technology providers.
By incorporating genuine incident details into fraudulent communications, attackers can make ordinary phishing emails appear more relevant and convincing.
Microsoft Urges Organisations To Strengthen Email Security Checks
Microsoft has advised security teams to use its Defender for Office 365 Threat Explorer and Defender XDR advanced hunting capabilities to identify suspicious messages, examine embedded links and investigate whether employees interacted with them.
The company has also recommended reviewing Microsoft Defender Safe Links settings.
Safe Links is a security feature that checks web addresses when users attempt to open them, helping identify potentially malicious destinations. Its effectiveness depends on appropriate configuration and the security policies applied by an organisation.
Businesses have been urged to verify service disruptions directly through the Microsoft 365 administration centre instead of relying on links contained in unexpected emails.
Organisations should also investigate suspicious sign-in activity and take appropriate action if employees have entered their credentials on unfamiliar websites.
Although Microsoft has identified targets across multiple US industries, it has not confirmed that Indian organisations were affected by this particular campaign.
Nevertheless, the warning is relevant to Indian businesses, government departments and educational institutions using Microsoft 365, particularly those managing large numbers of employee email accounts.
The incident highlights how cybersecurity risks can continue even after the technical problems responsible for a major service outage have been resolved.
What This Means For You:
Never click unexpected outage-recovery links or enter Microsoft account credentials on unfamiliar websites; verify service notifications directly through Microsoft’s official administration or service-health portal. If you have already submitted your credentials through a suspicious link, immediately notify your organisation’s IT security team, change your password and review account activity.
