Microsoft Warns Users of Phishing Attacks After Recent Outage
Microsoft has issued a new security warning after its Microsoft 365 outage. Microsoft warns users, about phishing emails that try to take advantage of the disruption. Microsoft says cybercriminals are pretending to be Microsoft service notifications. Microsoft says they send alerts to trick people into giving away their account credentials.
The warning comes days after Microsoft dealt with a major infrastructure outage on November 12 which disrupted services including Outlook and Teams for more than 24 hours. While services have since been restored the outage has created an opportunity for attackers to target users who may still be worried, about missing emails and service interruptions.
In a post, on X Microsoft Threat Intelligence said that hackers are sending messages that say emails kept during the outage might be lost forever. The fake messages ask recipients to click a link to get their messages back. The links go to shady sites not to the real Microsoft services.
Fake emails create urgency among users
Microsoft says that some of these messages warn recipients that their held emails will be deleted within 24 hours unless they follow the recovery instructions. The threat of losing messages is intended to make users act quickly without checking whether the notification is genuine.
Microsoft has also identified patterns that could help users recognise these emails. Microsoft subject lines follow the format “Outage. [Six-character code]”. Microsoft sender names are designed to resemble service notifications often combining organisation-specific prefixes with phrases such, as “Outage Notification” or “Service Health”.
The company has identified three domains linked to the campaign: moments-notice.com, planetmaison.com and newbooker.com. The fraudulent emails are said to include personalized SendGrid tracking links. These links send people to reallifeaccounting.com. Some of the links also have a webpage path that ends in /themelist0.html.
The campaign has targeted organisations across sectors in the US. Microsoft believes that the activity is consistent, with phishing. However, Microsoft has not confirmed whether the attackers have successfully stolen login details or distributed malware through the campaign.
What Microsoft advises users to do
Microsoft has advised security teams to use Microsoft Defender, for Office 365 Threat Explorer and Microsoft Defender XDR hunting. These tools help identify emails examine embedded links and check whether employees have interacted with them.
The company has also highlighted the importance of Safe Links, a security feature that helps protect users from URLs when configured correctly. Safe Links is a part of a good security plan. Organisations should review their existing security policies. Investigate any suspicious activity. Safe Links can stop links before they reach people. Keep your security policies up, to date. Check for any suspicious activity.
If you are an user the advice is very simple: do not click on links, in emails that come from unknown sources and say outage‑related recovery services can help you recover from outages. Instead look at the service updates yourself by going to the Microsoft 365 admin centre.
The incident is another reminder that cybercriminals often use technical problems to make their fraudulent messages appear believable. Microsoft’s recent outage may be over. Users still need to be cautious, about emails claiming to fix problems caused by the outage.