---
id: "CMP-202611-simgnz"
page: "https://infrastack.ai/live/CMP-202611-simgnz"
kind: "campaign"
aliases: []
title: "Fake Microsoft 365 outage emails say your held messages will be deleted in 24 hours unless you click 'restore', to steal Microsoft 365 logins (Microsoft, Field Effect)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Microsoft 365", "fixed": [], "vendor": "Microsoft"}, {"name": "Exchange Online", "fixed": [], "vendor": "Microsoft"}, {"name": "Outlook", "fixed": [], "vendor": "Microsoft"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-14T06:56:12+00:00"
updated_at: "2026-11-14T06:57:27+00:00"
sources: [{"source": "analyst", "url": "https://fieldeffect.com/blog/microsoft-365-outage-theme", "first_seen_at": "2026-11-14T06:56:12+00:00", "cites": ["https://fieldeffect.com/blog/microsoft-365-outage-theme"]}]
exploit_sources: []
---

# Fake Microsoft 365 outage emails say your held messages will be deleted in 24 hours unless you click 'restore', to steal Microsoft 365 logins (Microsoft, Field Effect)

Link for people: https://infrastack.ai/live/CMP-202611-simgnz (this .md is for agents)

Since 13 Nov 2026, phishing emails use the real Microsoft 365 outage of 12 Nov 2026 (Exchange Online incident EX1550543) as bait. They look like Microsoft 365 service health or quarantine notices, quote the real incident ID, and say messages held during the outage will be deleted within 24 hours unless the reader clicks to restore them. Microsoft Threat Intelligence saw them hit organizations in multiple US sectors. Field Effect saw the same text at several organizations, with a 'RESTORE MESSAGES' button that leads to a page that steals passwords. Microsoft says credential theft and malware delivery are not yet confirmed. Related outage-themed scams reported by Field Effect: fake Outlook password reset emails and texts, account recovery, MFA change and refund offers, fake Microsoft support calls asking for Quick Assist remote access, and texts from a 'manager or supplier whose email is down' asking for payment to a new account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Microsoft 365 affected range not listed fixed no fixed version listed
- :Exchange Online affected range not listed fixed no fixed version listed
- :Outlook affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The record describes fake Microsoft 365 outage emails sent to recipients that aim to steal logins, but it never says how the attacker got into any breached organisation, so entry is unknown.

How it reached others: their users got messages abusing it (phishing).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/breaches.md#phishing

## How to check

Subject: 'Outage - ' followed by a six-character code. Sender display name: an organization-specific prefix followed by 'Outage Notification' or 'Service Health'. Sender domains: moments-notice[.]com, planetmaison[.]com, newbooker[.]com. Links: recipient-specific SendGrid click-tracking links that redirect to reallifeaccounting[.]com (seen path /themelist0.html). Body: cites incident EX1550543, says (four) messages are held after the outage and will be deleted within 24 hours, 'RESTORE MESSAGES' button. Real quarantine digests come only from quarantine@messaging.microsoft.com with the subject 'Microsoft 365 security: You have messages in quarantine.' In Defender XDR, search EmailEvents, EmailUrlInfo and UrlClickEvents for these domains and for clicks on them since 12 Nov 2026.

## Fix

Do not click. Check outage status only in the Microsoft 365 admin center Service health page. Purge the matching messages and block the three sender domains and reallifeaccounting[.]com. Check that Safe Links policies are turned on. For anyone who clicked: reset the password, revoke sessions and tokens, and check Entra ID sign-in and audit logs since 12 Nov for new sign-in locations, OAuth consent grants and new MFA methods. Remove any new inbox or forwarding rules. Call back on a known number to confirm any password, MFA or payment change asked for during the outage. Allow Quick Assist and other remote support tools for IT staff only.

## Timeline

- 2026-11-14T06:56:12+00:00 analyst https://fieldeffect.com/blog/microsoft-365-outage-theme

## Documents

- [describes] @MsftSecIntel: Microsoft Threat Intelligence observed an active phishing campaign exploiting th https://x.com/MsftSecIntel/status/2121491564161581148
- [describes] Microsoft 365 outage theme drives credential phishing and support scams (Field Effect) https://fieldeffect.com/blog/microsoft-365-outage-theme

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_