MICROSOFT 365 · CMP-202611-simgnz · Vendor
NO FIX YET · SEE WHAT TO DO
Since 13 Nov 2026, phishing emails use the real Microsoft 365 outage of 12 Nov 2026 (Exchange Online incident EX1550543) as bait. They look like Microsoft 365 service health or quarantine notices, quote the real incident ID, and say messages held during the outage will be deleted within 24 hours unless the reader clicks to restore them. Microsoft Threat Intelligence saw them hit organizations in multiple US sectors. Field Effect saw the same text at several organizations, with a 'RESTORE MESSAGES' button that leads to a page that steals passwords. Microsoft says credential theft and malware delivery are not yet confirmed. Related outage-themed scams reported by Field Effect: fake Outlook password reset emails and texts, account recovery, MFA change and refund offers, fake Microsoft support calls asking for Quick Assist remote access, and texts from a 'manager or supplier whose email is down' asking for payment to a new account.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Outage - followed by a six-character codeOutage Notification or Service HealthRESTORE MESSAGES buttonMicrosoft 365 security: You have messages in quarantine. In Defender XDR, search EmailEvents, EmailUrlInfo and UrlClickEvents for these domains and for clicks on them since 12 Nov 2026Posts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.