Microsoft Outage Has Given Hackers A New Opportunity To Steal Your Passwords

Microsoft is warning users a phishing campaign that has emerged following its recent 36-hour infrastructure outage. Hackers are reportedly using the disruption to send fraudulent notifications that appear to come from Microsoft , claiming that emails delayed during the service interruption could be permanently deleted. In a post on X, Microsoft Threat Intelligence clarified that these alerts are fake and designed to trick users into clicking malicious links, potentially putting their accounts and login credentials at risk.

Fake Microsoft Emails Threaten To Delete Delayed Messages

The fraudulent messages use fear and urgency to convince recipients that their emails are at risk. According to Microsoft, some alerts claim that messages delayed during the outage will be permanently deleted within 24 hours unless users click a link to recover them. The emails reportedly follow a subject-line format such as "Outage - [six-character code]" and use sender names that resemble official service notifications, making them harder to distinguish from genuine Microsoft communications.

Microsoft Threat Intelligence observed an active phishing campaign exploiting the Microsoft 365 service disruption on November 12. The messages impersonate Microsoft 365 service health notifications and reference the legitimate Exchange Online incident EX1550543. Some of the phishing emails Microsoft detected on November 13 falsely claim that messages were held during the outage and will be deleted within 24 hours unless recipients click to restore them. Observed subjects follow the pattern "Outage - [six-character code]," with sender display names using organization-specific prefixes followed by "Outage Notification" or "Service Health." The campaign uses three sender domains, moments-notice[.]com, planetmaison[.]com, and newbooker[.]com, with recipient-specific SendGrid click-tracking links redirecting to reallifeaccounting[.]com, including the observed path /themelist0.html. Similar messages targeted organizations across multiple US sectors. The activity is consistent with credential phishing, although credential collection and malware delivery have not been confirmed. Security teams can use Microsoft Defender for Office 365 Threat Explorer and Microsoft Defender XDR advanced hunting (EmailEvents, EmailUrlInfo, and UrlClickEvents) to identify suspicious messages, examine embedded URLs, and investigate user clicks. Microsoft Defender for Office 365 Safe Links provides time-of-click protection against malicious URLs when properly configured. Organizations should verify their Safe Links policies, investigate potential user interactions, and confirm service disruptions directly through the Microsoft 365 admin center. — Microsoft Threat Intelligence (@MsftSecIntel) November 14, 2026

Microsoft Threat Intelligence observed an active phishing campaign exploiting the Microsoft 365 service disruption on November 12. The messages impersonate Microsoft 365 service health notifications and reference the legitimate Exchange Online incident EX1550543. Some of the phishing emails Microsoft detected on November 13 falsely claim that messages were held during the outage and will be deleted within 24 hours unless recipients click to restore them. Observed subjects follow the pattern "Outage - [six-character code]," with sender display names using organization-specific prefixes followed by "Outage Notification" or "Service Health." The campaign uses three sender domains, moments-notice[.]com, planetmaison[.]com, and newbooker[.]com, with recipient-specific SendGrid click-tracking links redirecting to reallifeaccounting[.]com, including the observed path /themelist0.html. Similar messages targeted organizations across multiple US sectors. The activity is consistent with credential phishing, although credential collection and malware delivery have not been confirmed. Security teams can use Microsoft Defender for Office 365 Threat Explorer and Microsoft Defender XDR advanced hunting (EmailEvents, EmailUrlInfo, and UrlClickEvents) to identify suspicious messages, examine embedded URLs, and investigate user clicks. Microsoft Defender for Office 365 Safe Links provides time-of-click protection against malicious URLs when properly configured. Organizations should verify their Safe Links policies, investigate potential user interactions, and confirm service disruptions directly through the Microsoft 365 admin center.

Hackers Use Suspicious Domains To Redirect Users

Microsoft has identified three domains linked to the phishing campaign: moments-notice.com, planetmaison.com and newbooker.com. The messages reportedly contain personalised tracking links generated through SendGrid, which redirect recipients to reallifeaccounting.com and suspicious webpages. The campaign has targeted organisations across multiple industries in the US. Microsoft believes the activity is aimed at stealing account credentials, although it has not established whether attackers have successfully obtained login details or distributed malware.

Microsoft Advises Organisations To Check Suspicious Emails

The company has asked security teams to investigate these messages using Microsoft Defender for Office 365 Threat Explorer and Defender XDR's advanced hunting tools. These services can help identify suspicious emails, examine embedded links and determine whether employees have interacted with them. Microsoft has also recommended reviewing Safe Links settings, which can help protect users from malicious URLs when configured properly.

How To Stay Safe From Microsoft Outage Phishing Scams

Microsoft advises users against clicking unexpected links in emails that demand urgent action to recover delayed messages or prevent their deletion. Instead, they should check service-related updates directly through the Microsoft 365 admin centre. The warning highlights how cybercriminals can exploit genuine technical disruptions to make fraudulent communications appear believable, potentially putting employee accounts and sensitive business information at risk.