Microsoft Issues Phishing Warning for Outlook and Teams Users After Major Outage

Microsoft has sent out a warning, for people who use Outlook and Teams. This happened after bad people started using the problem with Microsoft 365 to try to trick users with fake emails.

The warning came a day after a service outage on November 12 that knocked Microsoft 365 services for more than a day. It was hard for many people to use Outlook, Teams and other apps. Microsoft 365 had been down for, over 24 hours. Microsoft 365 was finally fixed. The outage gave cybercriminals a chance. They used the Microsoft 365 outage as a lure. Started phishing attacks.

In a post on X, which used to be called Twitter Microsoft said that their team that looks for threats found a phishing attack happening. In this attack people pretending to be from Microsoft sent messages, the status of Microsoft 365. These fake emails talked a problem that happened in Exchange Online called EX1550543 to make the emails look real.

The company has specifically warned users emails that say messages were held during the service disruption and will be deleted forever in 24 hours unless people click a link to get them back. I read the warning. Felt uneasy. Microsoft said that it found these emails on November 13 which was one day, after the service disruption.

What Microsoft said the phishing campaign

Microsoft Threat Intelligence has found a phishing campaign that's still active. This phishing campaign takes advantage of the Microsoft 365 service disruption that happened on November 12. The emails pretend to be Microsoft 365 service status messages. They even mention the real Exchange Online incident EX1550543.

Microsoft detected some phishing emails on November 13. Those phishing emails falsely claim that messages were held during the outage. Those phishing emails also claim that those messages will be deleted within 24 hours unless recipients click to restore them.

Observed subjects all follow the pattern "Outage. [Six-character code] ". The display names of the senders use prefixes specific to the organizations followed by "Outage Notification" or "Service Health." The campaign uses three sender domains, moments-notice.com, planetmaison.com and newbooker.com and the links in the messages use SendGrid click-tracking that redirect to reallifeaccounting.com including the path /themelist0.html. The same kind of messages were sent to organisations, in US sectors.

How users can stay safe

Microsoft has advised organisations not to trust unexpected emails, even if they appear to contain official service notifications. Instead, administrators should check for service-related updates directly through the Microsoft 365 admin center.

The company also recommends reviewing Safe Links policies, investigating whether employees have interacted with suspicious messages, and checking for potentially compromised accounts.

Users need to be careful and not click on any links or open any attachments in emails that try to make them feel worried by saying messages will be deleted or there is a problem with their account. Any message the outage, on November 12 should be checked by going to Microsoft’s official service channels.

The newest campaign shows how bad people online can use changes in technology. Even once the services are back to normal people should stay careful when they get emails that say they have solutions or that they need to fix missing messages or that they need to get updates, services.