Microsoft Warns of Phishing Scam Riding Its 36-Hour 365 Outage — Fake 'Restore Your Email' Alerts Target US Firms

By Hamza Faisal

Microsoft has warned of an active phishing campaign that is exploiting confusion around its 36-hour Microsoft 365 outage, sending fake service alerts designed to steal login credentials from organisations across the United States.

The warning, issued by Microsoft Threat Intelligence on Saturday, says the fraudulent emails impersonate Microsoft 365 service health notifications and cite the genuine Exchange Online incident, tracked as EX1550543, to make the messages look like part of the real outage response.

Some of the emails Microsoft detected on November 13 falsely claimed that messages held during the disruption would be permanently deleted within 24 hours unless recipients clicked a link to restore them. The company stressed that the phishing campaign is not the cause of the outage, which it has attributed to a server problem rather than any malicious activity.

How the fake alerts work

The phishing emails carry subject lines following the pattern "Outage – [six-character code]", while sender display names use organisation-specific prefixes followed by "Outage Notification" or "Service Health". That combination is designed to slip past busy employees who spent days waiting for their inboxes to come back.

Microsoft identified three sender domains behind the campaign: moments-notice.com, planetmaison.com and newbooker.com. The messages contain recipient-specific SendGrid click-tracking links that redirect victims to reallifeaccounting.com, a site with no connection to Microsoft.

The campaign has targeted organisations across multiple sectors in the United States. Microsoft said the activity is consistent with credential phishing, though it has not confirmed whether any credentials were actually collected or any malware delivered through the campaign.

A familiar playbook after a major outage

The disruption the scammers are riding began on November 12, when an Exchange Online failure knocked out email access for users in 74 countries, with Downdetector logging more than 130,000 reports at the peak. Microsoft said a large number of servers failed automated health checks during a network capacity upgrade and dropped out of rotation, overloading the systems that remained.

Services were restored over the following day and a half, but the outage left millions of workers unsure which messages had arrived and which were still queued — exactly the uncertainty a fake "restore your emails" alert is built to exploit.

Security researchers say the pattern is a familiar one: attackers move within hours of a high-profile outage, because a plausible recovery message is far more likely to be clicked while users are still anxious about lost mail.

What Microsoft advises

Microsoft urged organisations to verify any service disruption directly through the Microsoft 365 admin centre rather than clicking links in unsolicited emails. Security teams can use Microsoft Defender for Office 365 Threat Explorer and Defender XDR advanced hunting to identify suspicious messages, examine embedded links and check whether any employee clicked through.

Microsoft Defender for Office 365 Safe Links also provides time-of-click protection against malicious URLs when it is properly configured, the company said.

Anyone who received an "Outage" email and clicked through should treat their credentials as potentially exposed, change their password, review recent sign-ins and report the message to their security team.