Phishers quick to exploit extended M365 outage
Phishers have moved fast to exploit this week’s Microsoft 365 outage, sending fake service health notices that attempt to exploit the global disruption.
Microsoft Threat Intelligence said it had observed an active campaign that impersonated Microsoft 365 service health notifications and referenced the genuine Exchange Online incident EX1550543.
Some of the emails Microsoft detected falsely claimed that email messages had been held during the outage and would be deleted within 24 hours unless recipients clicked to restore them.
Message subject headings followed the pattern “Outage – [six-character code]”.
Sender display names used organisation-specific prefixes, followed by “Outage Notification” or “Service Health”.
Such tailoring could make the messages harder to ignore, particularly in inboxes already full of genuine outage updates.
The campaign used three sender domains: moments-notice[.]com, planetmaison[.]com and newbooker[.]com.
Messages used a recipient-specific SendGrid click-tracking link, which redirected to reallifeaccounting[.]com. Microsoft cited the path /themelist0.html as one example.
Microsoft said similar messages targeted organisations across multiple US sectors.
The company described the activity as consistent with credential phishing, but said this has not been confirmed.
For security teams, Microsoft pointed to Defender for Office 365 Threat Explorer, plus Defender XDR advanced hunting across the EmailEvents, EmailUrlInfo and UrlClickEvents tables, to find suspicious messages, examine embedded URLs and trace user clicks.
It also suggested Defender Safe Links, which provides time-of-click protection against malicious URLs “when properly configured”.
About Author
