Microsoft has warned of an active phishing campaign using the November 12 Microsoft 365 service disruption to lure users into opening fake email recovery links.
The messages copy Microsoft service health notices and cite the real Exchange Online incident EX1550543, making the requests appear linked to an ongoing business problem.
Microsoft Threat Intelligence detected emails on November 13 claiming that messages held during the outage would be deleted within 24 hours unless recipients clicked to restore them.
That deadline creates pressure to act quickly, particularly for employees already worried about missing customer messages, delayed payments, or other urgent business communications.
The warning follows the Microsoft 365 outage that affected Exchange Online and other cloud services. The phishing campaign takes advantage of that disruption, but it should not be confused with its cause. Microsoft’s outage updates said there was no indication that malicious activity had caused the underlying service failure.
Active Password Stealing Attack
The phishing emails use subject lines following the pattern “Outage – [six-character code].” Sender display names include organization-specific prefixes followed by “Outage Notification” or “Service Health.”
These details make the messages look like workplace notices, while the genuine incident number gives recipients another reason to believe the request is valid.
Microsoft identified three sender domains: moments-notice[.]com, planetmaison[.]com, and newbooker[.]com. Embedded links use recipient-specific SendGrid click tracking before redirecting to reallifeaccounting[.]com, including the path /themelist0.html. Similar messages reached organizations across multiple US sectors, showing that the activity was not limited to one company.
In its public threat intelligence warning, Microsoft described the activity as consistent with credential phishing. However, it has not confirmed credential collection or malware delivery.
The distinction matters. The observed emails and redirects support a phishing assessment, but they do not establish that passwords were successfully stolen or that devices were infected.
SendGrid links also appeared in a separate credential phishing campaign previously covered by Cybersecuritynews.com. That earlier reporting provides context for how attackers misuse trusted email services. It does not establish a connection between the campaigns, and Microsoft’s current warning does not identify the operator behind these outage-themed messages.
Microsoft recommends using Defender for Office 365 Threat Explorer and Defender XDR advanced hunting to investigate suspicious messages. The EmailEvents, EmailUrlInfo, and UrlClickEvents tables help teams examine email activity, embedded links, and user clicks. Investigators can use the reported sender domains, subject pattern, and redirect destination to guide their searches.
Organizations should also verify their Defender for Office 365 Safe Links policies. When properly configured, Safe Links provides time-of-click protection against malicious URLs.
Microsoft advises security teams to investigate potential user interactions rather than relying only on whether a suspicious message was delivered, because a recorded click needs further review.
For users, the key check is straightforward: confirm service disruptions directly through the Microsoft 365 admin center. An email citing a genuine outage number is not proof that its recovery link is safe.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
