Phishers are using Microsoft’s 365 outage as bait, Microsoft Threat Intelligence says

Microsoft Threat Intelligence says an active phishing campaign is using the 12 November Microsoft 365 outage as bait. The emails pose as Microsoft 365 service health notices and cite the real Exchange Online incident, EX1550543. Microsoft says credential collection and malware delivery haven’t been confirmed.

The warning came in a post on X from Microsoft Threat Intelligence on 14 November. Microsoft says it detected some of the emails on 13 November, a day after the outage began at 16:17 UTC on 12 November, and that similar messages targeted organisations across multiple US sectors. The outage itself is covered in an earlier report.

Microsoft Threat Intelligence observed an active phishing campaign exploiting the Microsoft 365 service disruption on November 12. The messages impersonate Microsoft 365 service health notifications and reference the legitimate Exchange Online incident EX1550543.

November 14, 2026

What the emails say

Microsoft says some of the emails falsely claim that messages were held during the outage and will be deleted within 24 hours unless the recipient clicks to restore them. The subjects follow the pattern “Outage – ” plus a six-character code, and the sender display names pair an organisation-specific prefix with “Outage Notification” or “Service Health”.

The incident number is real. Microsoft 365 Status published EX1550543 on X on 12 November, the first day of the outage, so anyone following its updates could copy it into a lure. Microsoft says each link is a SendGrid click-tracking link made for the individual recipient, and that it redirects to reallifeaccounting[.]com, including the path /themelist0.html. SendGrid is Twilio’s email delivery service, and a click-tracking link routes a click through the email service first so the sender can count it.

Security firm Field Effect caught one of the emails on 13 November and describes the same subject pattern and the 24-hour deletion threat. It says the message copies the layout of a Microsoft quarantine digest, lists four held messages and has a “RESTORE MESSAGES” button that leads to a credential harvesting page. Field Effect says the same text was reported at other organisations. Microsoft says it hasn’t confirmed that credentials were collected.

The domains behind it

Microsoft names three sender domains: moments-notice[.]com, planetmaison[.]com and newbooker[.]com. Registry records show none of them is new. Verisign’s RDAP service for .com domains, checked at 08:08 UTC on 14 November, lists moments-notice[.]com as registered in August 1996, planetmaison[.]com in November 2015, newbooker[.]com in December 2015 and the landing domain, reallifeaccounting[.]com, in September 1999. Gname.com is the registrar for moments-notice[.]com and reallifeaccounting[.]com, and Dynadot is the registrar for the other two.

Three of the four domains, planetmaison[.]com, newbooker[.]com and reallifeaccounting[.]com, use the same pair of Cloudflare name servers. moments-notice[.]com uses different ones and carries a client hold, the registrar status that stops a domain resolving. The landing domain carried no hold at the time of the check. The records show who holds the domains and how they’re set up. They don’t show who sent the emails.

What Microsoft hasn’t said

Microsoft hasn’t said how many organisations or recipients received the emails, or which sectors were hit beyond “multiple US sectors”. It hasn’t said whether anyone entered a password on the landing page. It describes the activity as consistent with credential phishing, and it hasn’t named a group behind it. Microsoft says it has no evidence of malicious activity associated with the outage itself.

It also hasn’t said whether Safe Links, the Defender for Office 365 feature that checks links when a user clicks them, was working when the emails were delivered. Microsoft’s post recommends Safe Links for time-of-click protection. Microsoft’s outage incident, MO1550821, listed Defender for Office 365 among the affected services, including Safe Links, according to eSecurity Planet, which says Microsoft reported that processing failures could stop users opening rewritten links in Outlook and Teams.

What defenders can check

Microsoft says security teams can use Threat Explorer in Defender for Office 365 and advanced hunting in Defender XDR, through the EmailEvents, EmailUrlInfo and UrlClickEvents tables, to find the messages, examine the URLs and investigate user clicks. It tells organisations to verify their Safe Links policies, investigate possible user interactions and confirm service disruptions directly in the Microsoft 365 admin center.

Field Effect adds two checks. Genuine quarantine digests come from [email protected] with the subject “Microsoft 365 security: You have messages in quarantine”, it says. It also says Entra sign-in and audit logs are kept for 30 or 90 days depending on licensing, and recommends exporting the logs that cover the outage window.

Other outage lures

Microsoft’s post covers email. Field Effect says outage-themed texts and fake IT support calls are also circulating, offering to restore messages, recover accounts or reset passwords, and it cites warnings from Australia’s National Cyber Security Coordinator and the Royal Dutch Pharmacists Association. The pattern isn’t new: Field Effect notes that during the 2024 CrowdStrike outage, attackers sent malware disguised as software that would fix the problem.

At the time of writing, Microsoft hasn’t published its post-incident report for the outage. Administrators can follow EX1550543 and MO1550821 in the Microsoft 365 admin center, and Microsoft’s public status page is at status.cloud.microsoft.