Microsoft Identifies Phishing Campaign Following Global 365 Outage
Microsoft identified a phishing campaign targeting users after a global Microsoft 365 outage disrupted services for businesses and hospitals on November 12.
A global outage of Microsoft 365 services on November 12 disrupted Outlook, Teams, and Copilot, impacting hospitals, transit providers, and businesses worldwide. Microsoft later attributed the disruption to infrastructure instability and unexpected server unavailability affecting Exchange Online mailboxes. While services have since been restored globally, the incident triggered a wave of opportunistic cyberattacks.
Microsoft Threat Intelligence identified an active phishing campaign targeting various sectors in the United States. Attackers are using fraudulent service health notifications that reference a legitimate incident code, EX1550543, to claim that emails held during the outage will be deleted within 24 hours unless restored via a malicious link. The campaign utilizes sender domains such as moments-notice[.]com and planetmaison[.]com to redirect victims to a credential-harvesting site.
Cybersecurity officials in Canada and the United Kingdom's National Cyber Security Centre warned that scammers often exploit the confusion following high-profile outages to impersonate IT help desks. Experts advised users to avoid clicking inbound links or providing multifactor authentication codes during unsolicited calls. Microsoft has urged organizations to use Defender for Office 365 and Defender XDR tools to audit suspicious activity and verify all notifications through the official admin center.
