- Microsoft warns of phishing targeting Microsoft 365 users via fake service health emails
- Phishing emails mimic Exchange Online outage EX1550543 with urgent message deletion claims
- Fraudulent emails use specific subject lines and sender names to appear legitimate
Microsoft has alerted users about an active phishing campaign in which cybercriminals are exploiting the company's recent Microsoft 365 service to trick recipients into clicking malicious links. In the cybercrime, the hackers are disrupting and potentially exposing their account credentials.
In a warning issued on Saturday, Microsoft said: "The messages impersonate Microsoft 365 service health notifications and reference the legitimate Exchange Online incident EX1550543. Some of the phishing emails Microsoft detected on November 13 falsely claim that messages were held during the outage and will be deleted within 24 hours unless recipients click to restore them."
According to Microsoft, the fraudulent emails use subject lines following the format "Outage - [six-character code]," while sender display names contain organisation-specific prefixes followed by phrases such as "Outage Notification" or "Service Health" to make the messages appear authentic.
Also Read | Layoffs Are Rising In Tech, But These Skills Are Helping People Unlock Better Pay
Microsoft identified three sender domains associated with the campaign: moments-notice[.]com, planetmaison[.]com and newbooker[.]com. The emails contain recipient-specific SendGrid tracking links that redirect users to reallifeaccounting[.]com, including a webpage hosted at the path /themelist0.html.
The campaign has reportedly targeted organisations across multiple sectors in the United States. Microsoft said the activity is consistent with credential phishing, although it has not confirmed whether account credentials have been collected or malware has been delivered.
Microsoft Threat Intelligence observed an active phishing campaign exploiting the Microsoft 365 service disruption on November 12. The messages impersonate Microsoft 365 service health notifications and reference the legitimate Exchange Online incident EX1550543. Some of the phishing emails Microsoft detected on November 13 falsely claim that messages were held during the outage and will be deleted within 24 hours unless recipients click to restore them. Observed subjects follow the pattern "Outage - [six-character code]," with sender display names using organization-specific prefixes followed by "Outage Notification" or "Service Health." The campaign uses three sender domains, moments-notice[.]com, planetmaison[.]com, and newbooker[.]com, with recipient-specific SendGrid click-tracking links redirecting to reallifeaccounting[.]com, including the observed path /themelist0.html. Similar messages targeted organizations across multiple US sectors. The activity is consistent with credential phishing, although credential collection and malware delivery have not been confirmed. Security teams can use Microsoft Defender for Office 365 Threat Explorer and Microsoft Defender XDR advanced hunting (EmailEvents, EmailUrlInfo, and UrlClickEvents) to identify suspicious messages, examine embedded URLs, and investigate user clicks. Microsoft Defender for Office 365 Safe Links provides time-of-click protection against malicious URLs when properly configured. Organizations should verify their Safe Links policies, investigate potential user interactions, and confirm service disruptions directly through the Microsoft 365 admin center.
— Microsoft Threat Intelligence (@MsftSecIntel) November 14, 2026
The company has urged organisations to "use Microsoft Defender for Office 365 Threat Explorer and Microsoft Defender XDR advanced hunting (EmailEvents, EmailUrlInfo, and UrlClickEvents) to identify suspicious messages, examine embedded URLs and investigate user clicks".
Microsoft also recommended verifying Safe Links protection policies to provide real-time checks against malicious URLs.
Users have been advised to verify service disruption notifications directly through the Microsoft 365 admin centre rather than clicking links in unexpected emails. The warning highlights how cybercriminals exploit genuine service outages to make phishing attacks appear credible and increase the likelihood of successful deception.
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.
