A phishing campaign aimed at U.S. organizations is turning Microsoft 365’s recent service interruption into a false recovery alert, using a deletion deadline to steer recipients toward a link, Microsoft Threat Intelligence said.
Emails detected Nov. 13 said messages delayed during the Nov. 12 disruption would be deleted after 24 hours unless recipients followed a link presented as a way to restore them. Microsoft said the notices referred to the genuine Exchange Online incident EX1550543, dated Nov. 12.
Microsoft said subject lines began with “Outage” followed by a six-character code. Display names paired an organization-specific prefix with either “Outage Notification” or “Service Health.” The company named moments-notice[.]com, planetmaison[.]com and newbooker[.]com as sender domains. Recipient-specific SendGrid tracking links redirected to reallifeaccounting[.]com, including /themelist0.html.
Similar messages targeted organizations across multiple U.S. sectors, Microsoft said. It gave no victim or message count and did not report how many people clicked. Microsoft described the activity as consistent with credential phishing, but had not confirmed credential collection or malware delivery.
Microsoft directed security teams to investigate suspicious messages, URLs and clicks through Threat Explorer in Microsoft Defender for Office 365 and advanced hunting in Microsoft Defender XDR. Its guidance pointed to the EmailEvents, EmailUrlInfo and UrlClickEvents tables for reviewing message, URL and click records. Microsoft also recommended reviewing Safe Links policies and checking service notices in the Microsoft 365 admin center.
The disruption impaired access to Exchange Online mailboxes and disrupted email delivery. Some Teams and Copilot functions that rely on Exchange Online were also affected, while Microsoft 365 features without that dependency continued operating, as EconoTimes covered in its report on the outage and restoration status.
