Microsoft has sounded the alarm over a phishing campaign that cleverly piggybacks on the Microsoft 365 service outage of November 12. The emails, identified on November 13 by Microsoft Threat Intelligence, urge recipients to click on a fake “recovery link” under a tight 24-hour deadline—claiming messages held during the outage will otherwise be permanently deleted. These messages appear designed to exploit urgency and uncertainty, especially around delayed business communications.
The attackers are copying real service health notifications and invoking Exchange Online incident number EX1550543 to make their emails look legitimate. Subject lines follow the format “Outage – [six-character code]” and sender names mimic Microsoft notices. The links in the messages redirect through SendGrid click trackers before landing on a site named reallifeaccounting.com with a path /themelist0.html. Domains observed delivering the emails include moments-notice[.]com, planetmaison[.]com, and newbooker[.]com—targets appear spread across multiple U.S. sectors.
Credentials, Not (Yet) Confirmed Malware
While Microsoft classifies the campaign as credential-phishing, it has not confirmed successful password theft or malware distribution. The distinction is important—based on observed indicators like phishing emails and URL redirects, Microsoft sees this as an effort to snag login details, not evidence yet of broader system compromise.
Defender for Office 365 users are urged to use built-in tools like Threat Explorer and Defender XDR advanced hunting to look into suspicious messages. Tables such as EmailEvents, EmailUrlInfo, and UrlClickEvents should be leveraged to track sender domains, subjects, link destinations, and employee clicks. Safe Links policies should be reviewed to enforce time-of-click protections.
Users, meanwhile, are advised not to trust an email simply because it references a real outage. A genuine incident number or service disruption notice isn’t a guarantee of safety. Instead, check the Microsoft 365 admin center directly to verify issues.
This campaign builds on earlier incidents where SendGrid-based links were used for credential phishing, though Microsoft has not linked those to this outage-based phishing wave or identified who is behind the attack. The company’s outage updates made clear that the disruption itself was not caused by malicious activity.
Analysis: This attack underscores how threat actors can use real service disruptions as a pretext to mount phishing operations. By invoking a known Microsoft incident number and citing urgency (message deletion), the campaign amplifies users’ risk at a moment of confusion. For organizations, the lesson is to strengthen detection around message delivery AND user interactions—clicks matter, not just inbox presence. For individuals, the key is confirmation through official channels rather than panic-driven responses. This kind of outage-themed phishing may become more common, especially as reliance on cloud services deepens. Expect attackers to exploit every breakdown as an opportunity.
