Microsoft 365 Outage Used as Bait: Fake Alerts Threaten Mail Deletion
Scammers are sending fake Microsoft 365 outage notices that reference the real Exchange Online disruption of Nov. 12, according to Microsoft Threat Intelligence, which said in an alert on Nov. 13 that it had found an active phishing campaign built around the incident. Some of the emails tell recipients that messages were held during the outage and will be deleted within 24 hours unless they click a link to restore them.
The emails cite the genuine Exchange Online incident number, EX1550543, which makes them look like real service notices. Microsoft said the activity matches credential phishing, meaning attempts to trick people into typing their work sign-in details on a fake page. The company also said it has not confirmed that any passwords were collected or that malware was delivered.
How the fake outage notices look
According to Microsoft, the subject lines follow a fixed pattern: the word “Outage” followed by a six-character code. The sender display names start with a prefix specific to the targeted organization, followed by “Outage Notification” or “Service Health,” so the message can appear to come from a company’s own IT team or from Microsoft.
Microsoft traced the messages to three sender domains: moments-notice[.]com, planetmaison[.]com and newbooker[.]com. Each email carries a SendGrid click-tracking link made for that specific recipient. The links send people on to reallifeaccounting[.]com, including a page at the path /themelist0.html, the company said. None of these domains belong to Microsoft.
Microsoft said similar messages reached organizations in several US sectors. Khaleej Times and TVC News both reported the warning, citing the company’s threat intelligence team.
What it means for people who lost email during the outage
The Nov. 12 Exchange Online disruption was real, and that is what gives the scam its pull. Anyone who saw mail delays that day may be inclined to trust a message saying their email is stuck and about to disappear. The 24-hour deadline in some of the emails adds pressure to click before checking.
Microsoft’s own advice is to confirm any service disruption directly in the Microsoft 365 admin center rather than through links in unsolicited notifications, as TVC News reported. For regular users, that check usually goes through an IT administrator. Our guide on checking Microsoft service health when Outlook stops working covers where official status updates appear.
Steps Microsoft gave security teams
Microsoft pointed administrators to tools they already have. Security teams can use Microsoft Defender for Office 365 Threat Explorer and Microsoft Defender XDR advanced hunting to find suspicious messages, inspect the links inside them and see whether employees clicked. In advanced hunting, the company named the EmailEvents, EmailUrlInfo and UrlClickEvents tables as places to look.
The company also recommended confirming that Safe Links policies are in place. Safe Links checks web addresses at the moment a user clicks them and blocks known malicious ones.
What is still unknown
Microsoft has not said how many organizations received the emails or which sectors were hit beyond describing them as several US sectors. It has not named who is behind the campaign. The company’s statement that credential theft and malware delivery have not been confirmed was the latest word in both reports.
Sources: Khaleej Times, TVC News