Microsoft Threat Intelligence detected an active credential phishing campaign targeting organizations across multiple US sectors by impersonating Microsoft 365 service health notifications and citing the legitimate Exchange Online incident code EX1550543. Emails intercepted on Nov 13 falsely warn recipients that messages held during the Nov 12 disruption will be deleted within 24 hours unless they click a link to restore them.
The lures use subject lines starting with “Outage -“ followed by a six character code and sender display names pairing organization prefixes with “Outage Notification” or “Service Health.” Sent from the domains moments-notice.com, planetmaison.com and newbooker.com, the messages use recipient-specific SendGrid click-tracking links to redirect users to reallifeaccounting.com. Microsoft said it had not yet confirmed credential collection or malware delivery and urged administrators to verify Defender for Office 365 Safe Links policies and check disruptions directly in the Microsoft 365 admin center.
The campaign followed a more than 24 hour outage across 74 countries and territories that disrupted Outlook, Teams, SharePoint and Copilot across a workplace suite with over 450 million commercial users before Microsoft completed root-cause repairs and restored all services on Saturday. Microsoft traced the outage itself to an earlier network capacity upgrade issue that surfaced after a recent network change, ruling out a cyberattack or AI agents.
