Hackers Exploit Microsoft 365 Outage for Phishing Attacks

• •Hackers are exploiting a recent Microsoft 365 outage to send phishing emails.
• •Fraudulent messages threaten email deletion to create urgency among users.
• •Microsoft has identified three domains linked to the phishing campaign.

Following a 36-hour Microsoft 365 outage on November 12, 2026, hackers launched a phishing campaign targeting users with fraudulent emails. These emails impersonate Microsoft service notifications, claiming that emails held during the outage will be deleted within 24 hours unless recipients click a link to restore them. The phishing messages utilize subject lines formatted as 'Outage - [six-character code]' and sender names that mimic official notifications. Microsoft identified three domains associated with the campaign: moments-notice.com, planetmaison.com, and newbooker.com, with links redirecting to reallifeaccounting.com. Although the campaign is consistent with credential phishing, Microsoft has not confirmed whether any credentials were successfully stolen or if malware was delivered. Security teams are advised to use Microsoft Defender tools to identify suspicious emails and verify service disruptions through official channels. The phishing campaign has targeted organizations across various sectors in the U.S.