Microsoft has warned organisations about an active phishing campaign exploiting confusion caused by the Microsoft 365 service disruption of November 12.
Microsoft Threat Intelligence said the scam emails impersonate Microsoft 365 service-health notifications and cite the legitimate Exchange Online incident reference, EX1550543, in an attempt to appear credible.
The campaign was observed as businesses and users dealt with a widespread outage that disrupted Outlook, Teams and other Microsoft 365 services in multiple regions.
According to Microsoft, the fraudulent emails detected on November 13 falsely tell recipients that messages were held during the outage and will be deleted within 24 hours unless they click a link to restore them.
The company said the tactic is consistent with credential phishing, though it had not confirmed whether attackers collected credentials or delivered malware through the campaign.
Real outage used as a scam lure
The phishing messages are designed to exploit a genuine service incident, using the legitimate EX1550543 reference to give recipients a false sense of trust.
Microsoft said the emails use subject lines following the pattern: “Outage – [six-character code].” Sender display names also use organisation-specific prefixes followed by phrases such as “Outage Notification” or “Service Health.”
The attackers are attempting to create urgency by warning users that delayed messages could be permanently deleted unless immediate action is taken.
Microsoft said the messages were sent from three domains: moments-notice[.]com, planetmaison[.]com and newbooker[.]com.
The emails use recipient-specific SendGrid click-tracking links that redirect users to reallifeaccounting[.]com, including an observed path, /themelist0.html.
Similar messages have targeted organisations in multiple sectors in the United States. Microsoft did not confirm whether organisations outside the US had been targeted.
Verify outages through official channels
Microsoft urged organisations to confirm service disruptions through the Microsoft 365 admin centre rather than clicking links in emails claiming to be service-health alerts.
Security teams have been advised to use Microsoft Defender for Office 365 Threat Explorer and Microsoft Defender XDR advanced hunting tools to identify suspicious messages, review embedded URLs and investigate whether users clicked the links.
The company said analysts can use data from EmailEvents, EmailUrlInfo and UrlClickEvents to trace potentially affected emails and user activity.
Microsoft Defender for Office 365 Safe Links can provide time-of-click protection against malicious URLs where it has been properly configured.
Organisations have been urged to review their Safe Links policies, investigate any possible user interaction with the phishing emails and alert staff about the scam.
The warning underlines how cybercriminals quickly exploit high-profile service disruptions, especially when users are already expecting delayed emails or problems accessing work platforms.
