Hackers exploit Microsoft 365 outage to target users with phishing emails

Microsoft has urged security teams to use its Defender for Office 365 and Defender XDR platforms to identify suspicious messages, examine embedded links and investigate whether employees clicked on them.

Microsoft has urged security teams to use its Defender for Office 365 and Defender XDR platforms to identify suspicious messages, examine embedded links and investigate whether employees clicked on them.

Cybercriminals are exploiting the recent Microsoft 365 service disruption to trick users into clicking malicious links through emails disguised as official service notifications, the software company announced on Saturday. The announcement was made after Microsoft Threat Intelligence detected an active phishing campaign on November 13, a day after the November 12 disruption, with attackers impersonating Microsoft 365 service health alerts and referencing a legitimate Exchange Online incident. The fraudulent emails falsely claim that messages were held during the outage and will be permanently deleted within 24 hours unless recipients click on a link to restore them. More To Read Microsoft rules out 'malicious activity' as cause for global outage Global Microsoft outage disrupts Outlook and Teams Microsoft to shut down Outlook Lite app in May Vibe coding: Why this AI trend is raising alarm among developers Microsoft says Copilot AI not for critical decisions, warns against overreliance Microsoft brings Copilot AI assistant to current-gen Xbox consoles Microsoft said the emails use subject lines following the format "Outage - [six-character code]," while the sender names combine organisation-specific prefixes with phrases such as "Outage Notification" or "Service Health". It added that the campaign is also using three sender domains: moments-notice.com , planetmaison.com and newbooker.com , with links embedded in the emails redirecting recipients to an external website, reallifeaccounting.com. The campaign has targeted organisations across multiple sectors in the United States, although Microsoft has not confirmed whether the attackers successfully harvested login credentials or delivered malware. Latest Stories AfDB commits Sh19.49 billion to boost long-term credit for Kenyan small businesses Food supplies to shrink for first time in four years amid El Niño threat - report Prostate cancer: Why early screening could save more Kenyan lives Kenya silent as Malawi general's arrest exposes alleged arms route to Sudan's RSF "The activity is consistent with credential phishing, although credential collection and malware delivery have not been confirmed," the organisation said. The messages are designed to create urgency and exploit users' concerns over lost emails, increasing the likelihood that recipients will follow the instructions without verifying the sender. Microsoft has urged security teams to use its Defender for Office 365 and Defender XDR platforms to identify suspicious messages, examine embedded links and investigate whether employees clicked on them. Organisations have also been advised to verify their safe links protection settings, investigate potentially affected accounts and confirm service disruptions through the official Microsoft 365 admin centre rather than links contained in unsolicited emails. Other Topics To Read Microsoft 365 Microsoft Outlook Teams Microsoft outage Copilot

Microsoft rules out 'malicious activity' as cause for global outage

Global Microsoft outage disrupts Outlook and Teams

Microsoft to shut down Outlook Lite app in May

Vibe coding: Why this AI trend is raising alarm among developers

Microsoft says Copilot AI not for critical decisions, warns against overreliance

Microsoft brings Copilot AI assistant to current-gen Xbox consoles

AfDB commits Sh19.49 billion to boost long-term credit for Kenyan small businesses

Food supplies to shrink for first time in four years amid El Niño threat - report

Prostate cancer: Why early screening could save more Kenyan lives

Kenya silent as Malawi general's arrest exposes alleged arms route to Sudan's RSF

Top Stories Today Three dead, 11 injured in Riverside perimeter wall collapse as rescue operation continues Fuel prices to remain unchanged with petrol retailing at Sh226.96, diesel at Sh227.76 in November review AfDB commits Sh19.49 billion to boost long-term credit for Kenyan small businesses Food supplies to shrink for first time in four years amid El Niño threat - report Prostate cancer: Why early screening could save more Kenyan lives Kenya silent as Malawi general's arrest exposes alleged arms route to Sudan's RSF

Three dead, 11 injured in Riverside perimeter wall collapse as rescue operation continues

Fuel prices to remain unchanged with petrol retailing at Sh226.96, diesel at Sh227.76 in November review

AfDB commits Sh19.49 billion to boost long-term credit for Kenyan small businesses

Food supplies to shrink for first time in four years amid El Niño threat - report

Prostate cancer: Why early screening could save more Kenyan lives

Kenya silent as Malawi general's arrest exposes alleged arms route to Sudan's RSF

Sign in with Google to , , and like .