Microsoft Threat Intelligence has warned of an active phishing campaign that piggybacks on genuine confusion from a real Microsoft 365 service disruption, using the incident’s actual tracking number to make fraudulent “restore your email” messages look legitimate.

Turning a Real Outage Into a Lure

On November 12, Exchange Online and several other Microsoft 365 cloud services suffered a disruption that Microsoft later tracked under incident number EX1550543. Microsoft’s own status updates said there was no indication that malicious activity caused the underlying failure — but by November 13, Microsoft Threat Intelligence was already observing phishing emails built around it.

The messages copy the format of a genuine Microsoft service health notice and cite the real EX1550543 incident number, a detail that gives the lure far more credibility than a generic phishing attempt. They claim that messages held during the outage will be permanently deleted within 24 hours unless the recipient clicks through to “restore” them — a deadline designed to push employees, particularly those already anxious about missed customer messages or delayed payments, into acting before they think to verify.

How the Campaign Is Built

Microsoft identified a consistent pattern across the messages:

• Subject lines following the format “Outage – [six-character code]”
• Sender display names combining an organization-specific prefix with “Outage Notification” or “Service Health”
• Embedded links routed through recipient-specific SendGrid click-tracking before redirecting to the domain reallifeaccounting[.]com

Microsoft has linked the campaign to three sender domains — moments-notice[.]com, planetmaison[.]com, and newbooker[.]com — and says similar messages reached organizations across multiple U.S. sectors, indicating a broad, opportunistic campaign rather than a targeted attack on a single company.

Microsoft draws a distinction that matters here: the activity is consistent with credential phishing, but the company has not confirmed that any passwords were actually stolen or that devices were infected. The outage itself and the phishing campaign exploiting it are two separate things, and conflating them risks either understating the social-engineering risk or overstating the technical impact of the original disruption.

Not the First Time SendGrid Has Been Abused This Way

The use of SendGrid’s legitimate click-tracking infrastructure to disguise a malicious redirect is not new; a separate credential-phishing campaign previously documented by security researchers relied on the same trusted-service technique. Microsoft has not said whether the two campaigns share an operator, and the current advisory does not name the group behind the Microsoft 365 outage lure.

What Security Teams and Employees Should Check

Microsoft recommends that security teams use Defender for Office 365 Threat Explorer and Defender XDR advanced hunting — specifically the EmailEvents, EmailUrlInfo, and UrlClickEvents tables — to search for the reported sender domains, the “Outage – [code]” subject pattern, and the reallifeaccounting[.]com redirect path.

Organizations should also confirm that Safe Links policies in Defender for Office 365 are properly configured, since time-of-click protection is one of the few controls that can still catch a malicious link after a message has already reached an inbox. Microsoft is also advising teams to investigate whether flagged messages were actually opened or clicked, rather than assuming delivery alone means no risk.

For individual users, the practical takeaway is simple: a genuine incident number does not make a recovery link genuine. Anyone unsure whether a service disruption is real should check the Microsoft 365 admin center directly rather than clicking a link in an email, however convincing the reference number looks.

Why Outage-Themed Lures Keep Working

Campaigns that attach themselves to a real, ongoing disruption tend to outperform generic phishing because they solve the attacker’s hardest problem for them: getting the target to believe the premise before they’ve had time to think critically about it. An employee who has personally noticed delayed email, slow logins, or a help-desk ticket about an outage is already primed to accept a message that claims to explain, and fix, exactly that problem. Security teams that build playbooks for major outages — both their own internal communications and anticipated phishing attempts riding on top of them — tend to catch these campaigns faster than teams treating each incident as a one-off.