Microsoft warns hackers are exploiting its recent outage to send phishing emails, steal credentials

After Microsoft's November 12 server outage, the company warns that hackers may exploit the incident to send fake email recovery alerts. The phishing messages threaten users with email deletion and could be designed to steal login credentials.

Microsoft has just fought its way through a 36-hour infrastructure outage , and it has barely caught its breath before another problem arrives at the door. The company is warning users a phishing campaign started by hackers that is taking advantage of its recent Microsoft 365 outage to trick people into clicking malicious links.

Hackers use fake outage notifications to trick Microsoft 365 users

According to Microsoft, some of the fraudulent emails claim that messages were held during the outage and will be deleted within 24 hours unless recipients click a link to restore them. This creates a sense of urgency, pushing users to act before checking whether the notification is genuine.

The emails use subject lines following the pattern "Outage - [six-character code]". Their sender display names also imitate service notifications, using organisation-specific prefixes followed by phrases such as "Outage Notification" or "Service Health".

Microsoft identified three sender domains associated with the campaign, such as moments-notice.com, planetmaison.com and newbooker.com. The emails contain recipient-specific SendGrid tracking links that redirect users to reallifeaccounting.com, including a suspicious webpage path ending in /themelist0.html.

The campaign has targeted organisations across multiple sectors in the US. Microsoft says the activity is consistent with credential phishing, although it has not confirmed whether attackers successfully collected login details or delivered malware.

Microsoft recommends that security teams use Microsoft Defender for Office 365 Threat Explorer and Defender XDR advanced hunting to identify suspicious messages, inspect embedded URLs and investigate whether employees clicked the links.

The company also points to Safe Links, which can provide protection against malicious URLs when configured correctly. Organisations should review their Safe Links policies and investigate possible user interactions with suspicious messages.

Microsoft's advice is simple: do not trust unexpected outage notifications asking you to restore emails or take urgent action. Users should verify service disruptions directly through the Microsoft 365 admin centre instead of clicking links in suspicious messages.

The warning comes as cybercriminals increasingly use real-world disruptions to make phishing attempts appear legitimate. In this case, a genuine Microsoft outage has become an opportunity for attackers to impersonate the company and potentially compromise business accounts. - Ends

I’m a journalist who loves reading and exploring diverse realms.

I’m a journalist who loves reading and exploring diverse realms.