Technology1 min read

Microsoft warns Outlook, Teams users against fake outage emails

By · Via Times of India · Published by Everything Blog

In short

The fraudulent messages specifically cite legitimate Exchange Online incident EX1550543 and threaten that delayed messages will be permanently deleted within 24 hours. Attackers are routing traffic through SendGrid click-tracking links toward the domain reallifeaccounting[.]com, though Microsoft has not yet confirmed credential theft or malware deployment. System administrators are urged to authenticate all system incidents solely via the official admin portal rather than through incoming email notices.

Key points

  • Organizations should advise staff to verify all cloud service disruptions exclusively thr…: Organizations should advise staff to verify all cloud service disruptions exclusively through the Microsoft 365 admin center.
  • Security administrators must check Safe Links policies and leverage Microsoft Defender XD…: Security administrators must check Safe Links policies and leverage Microsoft Defender XDR advanced hunting to track compromised interactions.
  • While the threat aligns with credential phishing techniques, investigators have not yet c…: While the threat aligns with credential phishing techniques, investigators have not yet confirmed secondary malware delivery or stolen credentials.

Sources checked by our analysis pipeline: 1

Microsoft has issued an email warning for Outlook and Teams users following a 24-hour-plus Microsoft 365 service disruption on November 12. In an X (formerly Twitter) post, the company said that cybercriminals are exploiting the outage to send phishing emails that impersonate official service health notifications. Some messages claim that emails held during the disruption will be deleted within 24 hours unless users click a link to restore them. Microsoft has urged organisations to verify service alerts through the Microsoft 365 admin centre and investigate suspicious emails. "Microsoft Threat Intelligence observed an active phishing campaign exploiting the Microsoft 365 service disruption on November 12. The messages impersonate Microsoft 365 service health notifications and reference the legitimate Exchange Online incident EX1550543," the post said.

"Organizations should verify their Safe Links policies, investigate potential user interactions, and confirm service disruptions directly through the Microsoft 365 admin center,” it stated.

Here’s what Microsoft said

In the X post, Microsoft Threat Intelligence wrote:

“Microsoft Threat Intelligence observed an active phishing campaign exploiting the Microsoft 365 service disruption on November 12. The messages impersonate Microsoft…

Technology

More in Technology