{"id":"CMP-202611-simgnz","kind":"campaign","aliases":[],"related":[],"title":"Fake Microsoft 365 outage emails say your held messages will be deleted in 24 hours unless you click 'restore', to steal Microsoft 365 logins (Microsoft, Field Effect)","description":null,"summary":"Since 13 Nov 2026, phishing emails use the real Microsoft 365 outage of 12 Nov 2026 (Exchange Online incident EX1550543) as bait. They look like Microsoft 365 service health or quarantine notices, quote the real incident ID, and say messages held during the outage will be deleted within 24 hours unless the reader clicks to restore them. Microsoft Threat Intelligence saw them hit organizations in multiple US sectors. Field Effect saw the same text at several organizations, with a 'RESTORE MESSAGES' button that leads to a page that steals passwords. Microsoft says credential theft and malware delivery are not yet confirmed. Related outage-themed scams reported by Field Effect: fake Outlook password reset emails and texts, account recovery, MFA change and refund offers, fake Microsoft support calls asking for Quick Assist remote access, and texts from a 'manager or supplier whose email is down' asking for payment to a new account.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-14T06:56:12+00:00","products":[{"name":"Microsoft 365","fixed":[],"vendor":"Microsoft"},{"name":"Exchange Online","fixed":[],"vendor":"Microsoft"},{"name":"Outlook","fixed":[],"vendor":"Microsoft"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Subject: 'Outage - ' followed by a six-character code. Sender display name: an organization-specific prefix followed by 'Outage Notification' or 'Service Health'. Sender domains: moments-notice[.]com, planetmaison[.]com, newbooker[.]com. Links: recipient-specific SendGrid click-tracking links that redirect to reallifeaccounting[.]com (seen path /themelist0.html). Body: cites incident EX1550543, says (four) messages are held after the outage and will be deleted within 24 hours, 'RESTORE MESSAGES' button. Real quarantine digests come only from quarantine@messaging.microsoft.com with the subject 'Microsoft 365 security: You have messages in quarantine.' In Defender XDR, search EmailEvents, EmailUrlInfo and UrlClickEvents for these domains and for clicks on them since 12 Nov 2026.","fix":"Do not click. Check outage status only in the Microsoft 365 admin center Service health page. Purge the matching messages and block the three sender domains and reallifeaccounting[.]com. Check that Safe Links policies are turned on. For anyone who clicked: reset the password, revoke sessions and tokens, and check Entra ID sign-in and audit logs since 12 Nov for new sign-in locations, OAuth consent grants and new MFA methods. Remove any new inbox or forwarding rules. Call back on a known number to confirm any password, MFA or payment change asked for during the outage. Allow Quick Assist and other remote support tools for IT staff only.","status":"open","published_at":null,"first_seen_at":"2026-11-14T06:56:12+00:00","triaged_at":"2026-11-14T06:56:12+00:00","updated_at":"2026-11-14T06:57:27+00:00","category":"vendor","confidence":null,"triage":{"cause":{"at":"2026-11-14T06:57:02Z","path":"phishing","entry":"unknown","reason":"The record describes fake Microsoft 365 outage emails sent to recipients that aim to steal logins, but it never says how the attacker got into any breached organisation, so entry is unknown.","confidence":0.6}},"analyst_status":"done","analyst_note":null,"search":"'-202611':29A '12':53B '13':41B '2026':43B,55B '24':14A,88B '365':3A,23A,32A,50B,66B 'access':173B 'account':157B,191B 'ask':168B,185B 'assist':171B 'bait':61B 'button':121B 'call':167B 'campaign':36B 'chang':160B 'click':18A,93B 'cmp':28A 'confirm':140B 'credenti':132B 'delet':12A,86B 'deliveri':136B 'earli':38B 'early-warn':37B 'effect':27A,109B,149B 'email':5A,45B,154B,182B 'ex1550543':59B 'exchang':56B 'exchange':33A 'fake':1A,150B,164B 'field':26A,108B,148B 'health':68B 'held':8A,80B 'hit':102B 'hour':15A,89B 'id':76B 'incid':58B,75B 'intellig':99B 'lead':123B 'like':64B 'login':24A 'look':63B 'malwar':135B 'manag':178B 'messag':9A,79B,120B 'mfa':159B 'microsoft':2A,22A,25A,31A,49B,65B,97B,130B,165B 'multipl':105B 'new':190B 'notic':71B 'nov':42B,54B 'offer':163B 'onlin':57B 'online':34A 'organ':103B,116B 'outag':4A,51B,83B,143B 'outage-them':142B 'outlook':35A,151B 'page':126B 'password':129B,152B 'payment':187B 'phish':44B 'quarantin':70B 'quick':170B 'quot':72B 'reader':92B 'real':48B,74B 'recoveri':158B 'refund':162B 'relat':141B 'remot':172B 'report':146B 'reset':153B 'restor':19A,95B,119B 'saw':100B,110B 'say':6A,78B,131B 'scam':145B 'sector':107B 'servic':67B 'sever':115B 'simgnz':30A 'sinc':40B 'steal':21A,128B 'supplier':180B 'support':166B 'text':113B,156B,175B 'theft':133B 'theme':144B 'threat':98B 'unless':16A,90B 'us':106B 'use':46B 'warn':39B 'whose':181B 'within':87B 'yet':139B","nicknames":["Microsoft 365 outage phishing","EX1550543 phishing"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["365","ex1550543phishing","exchangeonline","microsoft365","microsoft365outagephishing","online","outlook"],"ptokens":["365","exchange","microsoft","online","outlook"],"labels":["campaign","earlywarning","high","vendor"],"campaign_type":"phishing","search_a":"'-202611':29A '24':14A '365':3A,23A,32A 'click':18A 'cmp':28A 'delet':12A 'effect':27A 'email':5A 'exchange':33A 'fake':1A 'field':26A 'held':8A 'hour':15A 'login':24A 'messag':9A 'microsoft':2A,22A,25A,31A 'online':34A 'outag':4A 'outlook':35A 'restor':19A 'say':6A 'simgnz':30A 'steal':21A 'unless':16A","search_b":"'12':53B '13':41B '2026':43B,55B '24':88B '365':50B,66B 'access':173B 'account':157B,191B 'ask':168B,185B 'assist':171B 'bait':61B 'button':121B 'call':167B 'campaign':36B 'chang':160B 'click':93B 'confirm':140B 'credenti':132B 'delet':86B 'deliveri':136B 'earli':38B 'early-warn':37B 'effect':109B,149B 'email':45B,154B,182B 'ex1550543':59B 'exchang':56B 'fake':150B,164B 'field':108B,148B 'health':68B 'held':80B 'hit':102B 'hour':89B 'id':76B 'incid':58B,75B 'intellig':99B 'lead':123B 'like':64B 'look':63B 'malwar':135B 'manag':178B 'messag':79B,120B 'mfa':159B 'microsoft':49B,65B,97B,130B,165B 'multipl':105B 'new':190B 'notic':71B 'nov':42B,54B 'offer':163B 'onlin':57B 'organ':103B,116B 'outag':51B,83B,143B 'outage-them':142B 'outlook':151B 'page':126B 'password':129B,152B 'payment':187B 'phish':44B 'quarantin':70B 'quick':170B 'quot':72B 'reader':92B 'real':48B,74B 'recoveri':158B 'refund':162B 'relat':141B 'remot':172B 'report':146B 'reset':153B 'restor':95B,119B 'saw':100B,110B 'say':78B,131B 'scam':145B 'sector':107B 'servic':67B 'sever':115B 'sinc':40B 'steal':128B 'supplier':180B 'support':166B 'text':113B,156B,175B 'theft':133B 'theme':144B 'threat':98B 'unless':90B 'us':106B 'use':46B 'warn':39B 'whose':181B 'within':87B 'yet':139B","search_c":"","cause_entry":"unknown","cause_path":"phishing","disclosures_checked_at":null,"first_public_at":"2026-11-13T21:01:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-simgnz","url":"https://fieldeffect.com/blog/microsoft-365-outage-theme","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-14T06:56:12+00:00","fetched_at":"2026-11-14T06:56:12+00:00","note":null,"cites":["https://fieldeffect.com/blog/microsoft-365-outage-theme"]}],"documents":[{"id":153372,"url":"https://x.com/MsftSecIntel/status/2121491564161581148","title":"@MsftSecIntel: Microsoft Threat Intelligence observed an active phishing campaign exploiting th","kind":"post","source":"x","publisher":null,"text":"Microsoft Threat Intelligence observed an active phishing campaign exploiting the Microsoft 365 service disruption on November 12. The messages impersonate Microsoft 365 service health notifications and reference the legitimate Exchange Online incident EX1550543.\n\nSome of the https://t.co/NBvBf2mRFn\n\nlikes 233 reposts 112","published_at":"2026-11-14T06:32:58+00:00","relation":"describes","confidence":null,"note":null},{"id":153530,"url":"https://fieldeffect.com/blog/microsoft-365-outage-theme","title":"Microsoft 365 outage theme drives credential phishing and support scams (Field Effect)","kind":"blog","source":"analyst","publisher":null,"text":"Field Effect SEAS detected on 13 Nov 2026 a credential phishing email impersonating a Microsoft notification after the 12 Nov Microsoft 365 outage (incident EX1550543). Subject 'Outage - ' plus random six-character string; claims four messages held after the outage, deleted within 24 hours; 'RESTORE MESSAGES' button leads to credential harvesting page; same text seen at other organizations. Other outage-themed variants: fake Outlook password reset emails/texts, account recovery, MFA changes, inactive account deactivation, refund offers, fake Microsoft support calls (Quick Assist), payment redirection by text. Genuine quarantine digests come from quarantine@messaging.microsoft.com with subject 'Microsoft 365 security: You have messages in quarantine.'","published_at":"2026-11-13T21:01:28+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}