Microsoft Threat Intelligence has seen an active phishing campaign tied to this week's Microsoft 365 outage, iTnews reported. The fake emails pose as service health notices and name the real Exchange Online incident, EX1550543. Some warned that mail held back during the outage would be erased in a day unless people clicked to get it back.
Each email carried a link made for one recipient. It ran through SendGrid click tracking and ended at reallifeaccounting[.]com. The mail came from moments-notice[.]com, planetmaison[.]com and newbooker[.]com. Sender names began with a prefix matched to each organisation. Microsoft said similar messages hit organisations in several US sectors. It calls the activity consistent with credential phishing, meaning stolen logins, but has not confirmed that. The number of recipients is not stated.
The campaign borrows signals staff trust: a real incident number, a company-specific sender name and a known sending service. A click-tracking link works like a forwarding address. The first stop is the sender's service, and the final site only appears after the click. A check at delivery can miss that. Microsoft points to Safe Links, which checks at click time, but only "when properly configured". Buyers can ask two things: do staff have one agreed place for outage news, and who owns the Safe Links setup?