Tech News · Cybersecurity
Microsoft 365 outage phishing — what businesses should do now
“Microsoft Threat Intelligence observed an active phishing campaign exploiting the Microsoft 365 service disruption on November 12.”
— Microsoft Threat Intelligence, via X (reported by Cyber Security News)
What happened
A Microsoft 365 outage phishing campaign is now hitting business inboxes, Microsoft Threat Intelligence warned on November 14, 2026. Attackers are sending fake Microsoft 365 service health notices that piggyback on this week’s real Exchange Online disruption, which began on November 12, to trick employees into clicking malicious “recovery” links.
According to Microsoft, the emails reference the genuine Exchange Online incident number, EX1550543, which makes them look official. Some of the messages detected on November 13 claimed that email had been held during the outage and would be deleted within 24 hours unless the recipient clicked to restore it. Subject lines follow the pattern “Outage – [six-character code],” and sender display names combine the target organization’s own name with “Outage Notification” or “Service Health.”
Microsoft named three sender domains tied to the campaign (moments-notice[.]com, planetmaison[.]com and newbooker[.]com). The links pass through recipient-specific SendGrid click tracking before redirecting to another site, reallifeaccounting[.]com. Microsoft said similar messages reached organizations across multiple US sectors and described the activity as consistent with credential phishing, although it has not confirmed that passwords were actually collected or that malware was delivered. Importantly, the scam exploits the outage; it did not cause it.
FuzeForth’s take
This is the oldest trick in the book with a very modern polish. Every time a major cloud service stumbles, scammers move within hours, and this campaign shows how good they have become. Using the real incident number, your company’s own name in the sender field, and a 24-hour deletion threat is designed to catch a busy office manager who is already worried about missed client emails, delayed invoices or lost orders. If your team ran on Outlook and Teams this week, assume someone has seen one of these messages.
The businesses most at risk are small and mid-size firms without a dedicated IT person: accounting offices, law firms, clinics, logistics companies and agencies where one stolen Microsoft 365 login can expose email, shared files, invoices and client data, and can be used to send convincing fraud from your own address. The fix is mostly process, not expensive tools. Make it a rule that nobody restores email, re-enters a password or “verifies” an account from a link in a message. Real outage status lives in the Microsoft 365 admin center and on Microsoft’s official service health channels, not in an inbox.
Today, we recommend three actions. First, send a short note to your staff describing these emails and telling them to report rather than click. Second, ask whoever manages your Microsoft 365 tenant to search for the subject pattern and sender domains above, block them, and check whether anyone clicked. Third, confirm multifactor authentication is on for every account and that Safe Links is configured if you have Defender for Office 365. If you don’t have someone who can do this quickly, that gap is worth closing now with proactive security monitoring and maintenance, because the next outage will bring the next wave.
Key points
- Microsoft warned on November 14, 2026, of an active phishing campaign exploiting the November 12 Microsoft 365 outage.
- Fake service health emails cite the real Exchange Online incident EX1550543 and threaten to delete “held” email within 24 hours.
- Subject lines follow “Outage – [six-character code]”; sender names use the target company’s name plus “Outage Notification” or “Service Health.”
- Microsoft says the activity is consistent with credential phishing but has not confirmed stolen credentials or malware delivery.
- Always verify outages in the Microsoft 365 admin center, never through links in unsolicited emails.
Frequently asked questions
Is the Microsoft 365 outage phishing email real or fake?
It is fake. Microsoft does not ask users to click a link to restore email held during an outage, even though these messages mention a real incident number. Delete or report the email and check service status in the Microsoft 365 admin center instead.
What should I do if an employee clicked the link?
Have the employee change their Microsoft 365 password right away, sign out of all sessions, and confirm multifactor authentication is active. Your IT administrator should also review recent sign-ins, mailbox forwarding rules and any new MFA methods on that account. A professional security check can help confirm nothing else was changed.
Was the Microsoft 365 outage caused by hackers?
No. According to reporting on Microsoft’s updates, there was no indication that malicious activity caused the underlying service failure. Scammers are simply using the disruption as bait.
