Microsoft Threat Intelligence says attackers are exploiting the recent Microsoft 365 outage with fake service-health emails that cite the genuine Exchange Online incident EX1550543. Some messages detected on November 13 falsely tell recipients that emails held during the disruption will be deleted within 24 hours unless they click a link to restore them, according to a November 14 post from Microsoft Threat Intelligence.
The messages use subject lines following the pattern “Outage – [six-character code]” and sender display names with organisation-specific prefixes followed by “Outage Notification” or “Service Health.” Microsoft identified three sender domains: moments-notice[.]com, planetmaison[.]com and newbooker[.]com. The emails use recipient-specific SendGrid click-tracking links that redirect to reallifeaccounting[.]com, including the path /themelist0.html.
Microsoft said similar messages targeted organisations across multiple sectors in the United States. The activity is consistent with credential phishing, but the company has not confirmed that credentials were successfully collected or that malware was delivered. Field Effect separately said its email-analysis service detected an outage-themed lure on November 13 and that other variants were circulating, in its November 13 threat analysis.
The campaign followed a global Microsoft 365 disruption that affected Outlook, Teams and other services, as documented in the initial worldwide outage report and the subsequent service restoration update.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
