Microsoft has recently issued a warning about a phishing campaign exploiting the service disruption of Microsoft 365 on November 12. The attackers are leveraging this incident to send fake email recovery links, attempting to deceive users into revealing their credentials.
Phishing Tactics and User Deception
The phishing emails mimic official Microsoft service health notifications, referencing the real Exchange Online incident EX1550543 to increase authenticity. Users are pressured to respond quickly, fearing potential loss of important communications.
These emails claim that messages delayed by the outage risk deletion within 24 hours unless users click on provided links. This urgency targets employees concerned about missing critical information such as customer messages or payment confirmations.
Email Characteristics and Identified Domains
Emails involved in this campaign often use subject lines formatted as “Outage – [six-character code]” and come from sender names that appear to be official, incorporating organization-specific prefixes. This tactic makes the messages seem legitimate.
Microsoft has identified three suspicious sender domains: moments-notice[.]com, planetmaison[.]com, and newbooker[.]com. Links within the emails utilize SendGrid click tracking, redirecting users to reallifeaccounting[.]com. This activity spans various sectors within the US.
Security Recommendations and User Precautions
Microsoft emphasizes the use of Defender for Office 365 Threat Explorer and Defender XDR for analyzing suspicious emails and activities. The tools can help track email events, URL information, and user interactions to assess potential threats.
Organizations are encouraged to verify their Safe Links policies in Defender for Office 365 to ensure real-time protection against malicious URLs. It’s crucial for security teams to investigate user interactions with suspicious messages rather than relying solely on delivery records.
Users should independently verify service disruptions via the Microsoft 365 admin center. A legitimate incident number in an email does not guarantee the safety of its recovery link.
Staying informed and vigilant is essential in protecting credentials from phishing attacks, especially during service disruptions that can be exploited by cybercriminals.
