Microsoft warns of phishing emails abusing Microsoft 365 outage
Original title: Microsoft Warns of Active Password Stealing Attack Exploiting the Microsoft 365 Service Disruption
Messages cite real Exchange Online incident EX1550543 and warn held mail will be deleted within 24 hours.
Microsoft Threat Intelligence warned of phishing emails detected on November 13 that used the November 12 Microsoft 365 disruption to push fake recovery links. The messages copy service health notices, cite Exchange Online incident EX1550543, and claim held mail will be deleted within 24 hours unless recipients click to restore it. Microsoft called the activity consistent with credential phishing but has not confirmed stolen passwords or malware. It also said malicious activity did not cause the outage.
Unconfirmed: Microsoft has not confirmed credential theft or malware delivery and has not named the operator.
- Subject lines follow the pattern “Outage – [six-character code].”
- Sender domains include moments-notice.com, planetmaison.com and newbooker.com.
- Links use recipient-specific SendGrid tracking, then redirect to reallifeaccounting.com.
- Similar messages reached organizations across multiple US sectors.
- Microsoft points hunters to EmailEvents, EmailUrlInfo and UrlClickEvents.
Impact: lure users toward fake links consistent with credential phishing
- 1.Confirm disruptions in the Microsoft 365 admin center, not via email links.
- 2.Hunt in Defender using the reported domains, subject pattern and redirect destination.
- 3.Review Safe Links policies and investigate recorded user clicks.
- Vendors
- Microsoft
- Organizations
- Microsoft Threat Intelligence
- Countries
- United States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | moments-notice.com | equest is valid. Microsoft identified three sender domains: moments-notice[.]com, planetmaison[.]com, and newbooker[.]com. Embedded links |
| domain | newbooker.com | nder domains: moments-notice[.]com, planetmaison[.]com, and newbooker[.]com. Embedded links use recipient-specific SendGrid click tra |
| domain | planetmaison.com | soft identified three sender domains: moments-notice[.]com, planetmaison[.]com, and newbooker[.]com. Embedded links use recipient-specif |
| domain | reallifeaccounting.com | ient-specific SendGrid click tracking before redirecting to reallifeaccounting[.]com, including the path /themelist0.html. Similar messages re |
From the original article
3 min read at cybersecuritynews.com
Microsoft has warned of an active phishing campaign using the November 12 Microsoft 365 service disruption to lure users into opening fake email recovery links. The messages copy Microsoft service health notices and cite the real Exchange Online incident EX1550543, making the requests appear linked to an ongoing business problem. Microsoft Threat Intelligence detected emails […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.