Fake Microsoft 365 Outage Emails: How to Spot the Scam

On November 14, Microsoft Threat Intelligence warned about an active phishing campaign that exploits the November 12 Microsoft 365 service disruption. The messages impersonate Microsoft 365 service health notifications and reference the real Exchange Online incident, EX1550543.

Some of the emails Microsoft saw on November 13 claim that messages were held during the outage and will be deleted within 24 hours unless the recipient clicks to restore them. The screenshot Microsoft shared shows a message titled "Action required: (4) messages held after the outage" with a yellow "Restore messages" button.

Two things are worth being clear about:

• The outage was real, and the scam is separate. Microsoft's outage updates said there was no indication that malicious activity caused the underlying service failure. The attackers are exploiting the aftermath, not causing it.
• Nobody has said passwords were stolen. Microsoft describes the activity as consistent with credential phishing, but says credential collection and malware delivery have not been confirmed. It also hasn't published how many organizations or accounts were affected.

Microsoft says similar messages targeted organizations across multiple US sectors.

The trick is borrowed credibility. A genuine incident number makes the email feel connected to a real problem you are already dealing with. A 24-hour deadline then pushes you to act before you think. This is a classic pressure play, and it works best on someone who is already worried about missed customer emails or delayed payments.

Based on Microsoft's description, the chain looks like this:

1. The email arrives. The subject follows the pattern "Outage – " plus a six-character code. The sender's display name starts with an organization-specific prefix, followed by "Outage Notification" or "Service Health," so it can look like it came from your own workplace.
2. The link is tracked. The links use recipient-specific click tracking through SendGrid, a legitimate email service. That does not mean SendGrid is the problem. Attackers are using its click-tracking links to wrap their own destination.
3. The click redirects. The wrapped link redirects to a site called reallifeaccounting[.]com. Microsoft cited the path /themelist0.html as an example. We have not browsed to it, and neither should you.
4. The likely goal is your login. Microsoft's assessment is credential phishing: a page designed to get you to type a username and password.

Microsoft named three sender domains: moments-notice[.]com, planetmaison[.]com and newbooker[.]com. (The square brackets keep these from becoming clickable links. Please don't visit them.)

Share this section with your staff.

• A message about "held" or "deleted" email that asks you to click. Treat any unexpected message that asks you to click to rescue email as suspicious until you've checked it another way.
• A short deadline. "Within 24 hours" is there to hurry you.
• A subject starting with "Outage –" and a short code. That exact pattern is in Microsoft's warning.
• A sender name that includes your company name plus "Outage Notification" or "Service Health." The name is easy to fake. Look at the actual sending address, and remember that a familiar name doesn't prove who sent it.
• A real incident number. EX1550543 is genuine, which is the point. A true number doesn't make the link safe.
• A "Restore" or "Review" button instead of a plain explanation. Real outage updates are published on Microsoft's service health pages.

What to do instead:

• Don't click. Don't open attachments.
• Check the outage status where Microsoft tells you to: the Microsoft 365 admin center. Ask your IT contact if you can't get there.
• Report the email. In Outlook, use Report, then Report phishing, if your organization has it turned on. Otherwise, forward it to your IT team the way they've told you.
• If you clicked and typed nothing, close the page and tell IT. If you typed your password, tell IT right away so they can reset it and check your account.

Microsoft's guidance for security teams is specific. The core steps:

• Hunt for the messages. Use Microsoft Defender for Office 365 Threat Explorer and Defender XDR advanced hunting across the EmailEvents, EmailUrlInfo and UrlClickEvents tables. Search on the three sender domains, the "Outage – [code]" subject pattern, and the redirect destination.
• Investigate clicks, not only deliveries. Microsoft advises looking at what users did with the messages. A message that reached an inbox is one thing. A recorded click needs follow-up.
• Verify your Safe Links policies. Safe Links provides time-of-click protection against malicious URLs when it is properly configured. Make sure it is configured and applied to the people who need it.
• Confirm outages in the admin center. Tell your team that service disruptions are confirmed there, not through an emailed link.

Microsoft also said that Defender blocks the malicious domains used in this campaign and that Defender for Office 365 blocks and quarantines the phishing emails, and that it will share more findings.

For any user who clicked and may have entered credentials, general best practice (not specific to Microsoft's warning) is to review recent sign-ins, check for new inbox rules and changed multi-factor authentication settings, reset the password through a trusted route, and revoke active sessions.

Outage-themed phishing will not end with this campaign. Any big public disruption, whether it's Microsoft, your bank or your phone carrier, is an opening for this kind of scam. A few habits help:

• Go to the source, not the link. If a message says there's a problem with your account or email, open the service's own site or app directly.
• Slow down when the message creates urgency. Pressure is the tell. A real problem will still be there after you take two minutes to check.
• Agree on one place for real outage news. Pick it ahead of time (the admin center, a status page, or a text from IT) so your team knows what's real.
• Make reporting easy and judgment-free. People should never feel silly for forwarding a suspicious email.
• Keep an eye out for updates. Microsoft says it will continue to monitor this campaign and share additional findings.

If you aren't sure about an email, ask us before you click. LayerLogix helps Houston and The Woodlands businesses with this every day.

So you know where the facts stop: Microsoft hasn't confirmed that any credentials were collected or malware delivered. It hasn't named who is behind the campaign, and it hasn't published a victim count. It said US organizations in multiple sectors were targeted; it hasn't said whether organizations elsewhere were.

• Microsoft Threat Intelligence's original alert on X
• Our LayerLogix LinkedIn post on this scam
• The CVE Radar threat-intel breakdown on LinkedIn

1. Microsoft Threat Intelligence (@MsftSecIntel), post of Nov 14, 2026 (12:32 AM CT): https://x.com/MsftSecIntel/status/2121491564161581148
2. Microsoft Threat Intelligence (@MsftSecIntel), follow-up reply of Nov 14, 2026 (4:14 PM CT): https://x.com/MsftSecIntel/status/2121728397093032307
3. Cybersecuritynews, "Microsoft Warns of Active Password Stealing Attack Exploiting the Microsoft 365 Service Disruption," Nov 14, 2026: https://cybersecuritynews.com/active-password-stealing-attack-microsoft-365/
4. iTnews, "Phishers quick to exploit extended M365 outage," Nov 14, 2026: https://www.itnews.com.au/news/phishers-quick-to-exploit-extended-m365-outage-630347
5. NDTV Profit, "Microsoft 365 Users Targeted By Fake Outage Notifications In Phishing Campaign" (reproduces Microsoft's full post text): https://www.ndtvprofit.com/technology/microsoft-365-users-targeted-by-fake-outage-notifications-in-phishing-campaign-12326018
6. Secritic, "Scammers Use a Real Microsoft 365 Outage to Make Fake Emails Look Genuine," Nov 14, 2026 (reporting-and-response guidance; general best practice): https://secritic.com/2026/11/14/microsoft-365-outage-phishing-fake-emails-use-real-incident-id/