Phishers exploit Microsoft 365 outage with tailored links

Three malicious sender domains formed part of an active phishing operation that exploited this week’s extended Microsoft 365 outage, Microsoft Threat Intelligence said. The attackers did more than mention the global disruption: they impersonated service-health notifications and placed the lure inside inboxes already receiving legitimate outage notices.

How did the phishers exploit the outage?

Microsoft Threat Intelligence said it observed an active campaign impersonating Microsoft 365 service-health notifications. The messages referenced the genuine Exchange Online incident, EX1550543, while pairing that real identifier with links from the campaign.

Some emails falsely claimed that messages had been held during the outage and would be deleted within 24 hours unless recipients clicked to restore them. The notice therefore paired a familiar service problem with a short deadline and an instruction to act.

Takeaway: The lure borrowed the credibility of a real incident and attached a 24-hour deadline to it.

How convincing were the messages?

Subject headings followed the pattern “Outage - [six-character code]”. Sender display names used organisation-specific prefixes followed by “Outage Notification” or “Service Health”.

The tailoring could make the emails harder to ignore, particularly for users whose inboxes already contained genuine outage updates. A matching subject and a plausible display name could prompt a click before a reader checks the underlying sender domain.

Takeaway: Familiar wording and target-specific presentation made the messages look routine.

Where did the links lead?

The campaign used three sender domains: moments-notice[.]com, planetmaison[.]com and newbooker[.]com. The messages used recipient-specific SendGrid click-tracking links, which redirected to reallifeaccounting[.]com. Microsoft cited /themelist0.html as one example path.

Recipient-specific links let the campaign treat each message separately and track who interacted with the URL. Microsoft said similar messages targeted organisations across multiple US sectors, but it did not report a victim or organisation count.

Microsoft described the activity as consistent with credential phishing, while noting that this had not been confirmed.

Takeaway: Defenders can trace three sender domains and one named redirect destination, but Microsoft has not confirmed the credential-phishing classification.

What should security teams do?

Microsoft pointed investigators to three parts of its Defender tooling:

• Defender for Office 365 Threat Explorer: Find suspicious messages associated with the campaign.
• Defender XDR advanced hunting: Search the EmailEvents, EmailUrlInfo and UrlClickEvents tables to find suspicious messages, examine embedded URLs and trace user clicks.
• Defender Safe Links: Microsoft suggested the control for time-of-click protection against malicious URLs “when properly configured”.

Together, those controls cover message discovery, URL inspection and click tracing. The published indicators also give defenders concrete strings to search in mail and URL telemetry: three sender domains, the redirect domain and the example path. Microsoft attached a condition to its Safe Links recommendation, saying that administrators need to configure the service correctly for that protection to apply.

Takeaway: The outage supplied the credibility, the 24-hour threat supplied the urgency, and Microsoft has supplied concrete indicators and tools for the response.