Back Khaleejtimes

Microsoft finds active phishing campaign exploiting service disruption

Khaleejtimes • November 14, 2026

It said that similar messages targeted organisations across multiple US sectors, adding that activity is consistent with credential phishing

PUBLISHED: Sat 14 Nov 2026, 6:37 PM

Microsoft Threat Intelligence on Saturday found that an active phishing campaign was exploiting the Microsoft 365 service disruption on November 12.

The messages, it said, impersonate notifications from Microsoft, referencing legitimate Exchange Online incident EX1550543. "Some of the phishing emails Microsoft detected on November 13 falsely claim that messages were held during the outage and will be deleted within 24 hours unless recipients click to restore them."

It said that observed subjects follow the pattern "Outage - [six-character code]," with sender display names using organisation-specific prefixes followed by "Outage Notification" or "Service Health."

Stay up to date with the latest news. Follow KT on WhatsApp Channels.

The campaign uses three sender domains, moments-notice[.]com, planetmaison[.]com, and newbooker[.]com, with recipient-specific SendGrid click-tracking links redirecting to reallifeaccounting[.]com, including the observed path /themelist0.html.

It said that similar messages targeted organisations across multiple US sectors, adding that activity is consistent with credential phishing. It also said that credential collection and malware delivery have not been confirmed.

"Security teams can use Microsoft Defender for Office 365 Threat Explorer and Microsoft Defender XDR advanced hunting (EmailEvents, EmailUrlInfo, and UrlClickEvents) to identify suspicious messages, examine embedded URLs, and investigate user clicks."

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Hackers Exploit Microsoft 365 Outage for Phishing Attacks Following a 36-hour Microsoft 365 outage on November 12, 2026, hackers launched a phishing campaign targeting users with fraudulent emails. These emails impersonate Microsoft service notifications, claiming that emails held during the outage will be deleted within 24 hours unless recipients click a link to restore them. The phishing messages utilize subject lines formatted as 'Outage - [six-character code]' and sender names that mimic official notifications. Microsoft identified three domains associated with the campaign: moments-notice.com, planetmaison.com, and newbooker.com, with links redirecting to reallifeaccounting.com. Although the campaign is consistent with credential phishing, Microsoft has not confirmed whether any credentials were successfully stolen or if malware was delivered. Security teams are advised to use Microsoft Defender tools to identify suspicious emails and verify service disruptions through official channels. The phishing campaign has targeted organizations across various sectors in the U.S. 10 sources 65

Extracted Entities

Microsoft finds active phishing campaign exploiting service disruption

The full story

Extracted Entities

Attack Types (1)

Domains (4)

MITRE ATT&CK (1)

Platforms (2)

Tools (1)