Staff are getting emails that say mail held up by last week’s Microsoft 365 outage will be erased within a day unless they tap a restore button. Microsoft says the notices are fake, built to harvest work logins, and that the sender is trading on the real Exchange Online failure of 12 November.
What makes them convincing is the detail: they quote the genuine incident number, EX1550543, and dress up as service health alerts. The first ones turned up on 13 November, Microsoft’s threat team says. Subjects look like “Outage – ” followed by a six-character code, and the display name is an organisation-specific prefix plus “Outage Notification” or “Service Health”.
In its post on X, Microsoft Threat Intelligence names three domains the messages come from:
- moments-notice[.]com
- planetmaison[.]com
- newbooker[.]com
The button goes through a SendGrid tracking link and ends at reallifeaccounting[.]com. Companies in several US sectors received similar messages.
Microsoft’s read is credential phishing, where a fake page asks for your password. It has not established whether any passwords were collected or any malware was delivered.
The 24-hour threat is what pushes people to act. Someone already anxious about missed customer mail or delayed payments is more likely to click first. A real incident number proves nothing about the link: whether any mail was held should be checked in the Microsoft 365 admin center.
Security teams can hunt for the campaign in Defender XDR’s email and click tables, and Microsoft tells them to confirm their Safe Links policies are set up, since those check a link at the moment it is clicked. It also wants anyone who clicked followed up, not only a count of what was delivered.
Anyone who clicked and entered a password should change it, look over recent sign-ins and tell their administrator.
