Microsoft has recently experienced a significant 36-hour infrastructure outage, which has now led to a new challenge for the company. Following this disruption, Microsoft is alerting users to a phishing campaign allegedly initiated by cybercriminals. These attackers are reportedly leveraging the confusion caused by the outage to send fraudulent emails designed to deceive users into clicking on malicious links.

In a post on X, Microsoft Threat Intelligence disclosed that the hackers are impersonating official Microsoft service notifications. They claim that emails held during the outage are at risk of deletion, thereby creating a sense of urgency among users. However, these notifications are not authentic and are instead attempts to exploit the situation for malicious purposes.

Details of the Phishing Emails

According to Microsoft, some of the deceptive emails inform recipients that their messages were held during the outage and will be deleted within 24 hours unless they click a provided link to restore access. This tactic aims to instil a sense of urgency, prompting users to act quickly without verifying the authenticity of the notification.

The phishing emails typically feature subject lines that follow a specific pattern, such as “Outage – [six-character code].” Additionally, the sender display names mimic official service notifications, often using organisation-specific prefixes followed by phrases like “Outage Notification” or “Service Health.” This strategy is designed to lend an air of credibility to the fraudulent messages.

Microsoft has identified three domains linked to this phishing campaign: moments-notice.com, planetmaison.com, and newbooker.com. The emails include recipient-specific SendGrid tracking links, which redirect users to a suspicious website, reallifeaccounting.com, with a concerning URL path ending in /themelist0.html.

Recommendations for Users and Organisations

The phishing campaign has reportedly targeted various organisations across multiple sectors in the United States. Microsoft has indicated that this activity aligns with credential phishing tactics, although it has not confirmed whether the attackers successfully obtained login credentials or delivered malware through these emails.

To combat this threat, Microsoft recommends that security teams utilise Microsoft Defender for Office 365 Threat Explorer and Defender XDR advanced hunting tools. These resources can help identify suspicious messages, inspect embedded URLs, and determine if employees have interacted with the malicious links.

Furthermore, Microsoft advises organisations to review their Safe Links policies, which can offer protection against harmful URLs when configured properly. Users are urged to remain vigilant and not to trust unexpected outage notifications that prompt them to restore emails or take urgent actions. It is recommended that they verify any service disruptions directly through the Microsoft 365 admin centre rather than clicking on links in suspicious emails.

This warning comes amid a growing trend where cybercriminals exploit real-world disruptions to make their phishing attempts appear more legitimate. In this instance, the genuine Microsoft outage has provided an opportunity for attackers to impersonate the company, potentially compromising business accounts and sensitive information.

Long or Short, get news the way you like. No ads. No redirections. Download Newspin and Stay Alert, The CSR Journal Mobile app, for fast, crisp, clean updates!

App Store – https://apps.apple.com/in/app/newspin/id6746449540

Google Play Store – https://play.google.com/store/apps/details?id=com.inventifweb.newspin&pcampaignid=web_share