Phishers quick to exploit extended M365 outage

What happened

Microsoft Threat Intelligence said it had observed an active campaign that impersonated Microsoft 365 service health notifications and referenced the genuine Exchange Online incident EX1550543. Some of the emails Microsoft detected falsely claimed that email messages had been held during the outage and would be deleted within 24 hours unless recipients clicked to restore them.

The company described the activity as consistent with credential phishing (messages that impersonate someone to obtain passwords or money), but said this has not been confirmed. Home News Technology Security By Juha Saarinen Nov 14 2026 7:49PM Fake service health notices threaten to delete "held" email unless recipients click to restore it. Microsoft is a software and software development company based in Redmond. Phishers have moved fast to exploit this week's Microsoft 365 outage , sending fake service health notices that attempt to exploit the global disruption. Message subject headings followed the pattern "Outage - [six-character code]". Sender display names used organisation-specific prefixes, followed by "Outage Notification" or "Service Health". Messages used a recipient-specific SendGrid click-tracking link, which redirected to reallifeaccounting[.]com. Microsoft cited the path /themelist0.html as one example. Microsoft said similar messages targeted organisations across multiple US sectors.