Microsoft warns about scam attempts after failure in Teams and Outlook

Microsoft warned of an email scam campaign that takes advantage of the instability registered in Microsoft 365 on Thursday (12) to try to steal user data.

Criminals send fake messages that imitate official company communications and claim that emails were retained during the outage and will be deleted within 24 hours if the recipient does not click on a link to retrieve them.

The alert was released by Microsoft's threat intelligence team (Microsoft Threat Intelligence) on Friday (13), on the social network X. According to the company, the campaign refers to a real problem in Exchange Online, Microsoft's corporate email service, identified by code EX1550543.

"Some of the phishing emails we detected on November 13 falsely claim that messages were retained during the outage and will be deleted within 24 hours unless recipients click to restore them," the team said.

The scam uses messages with subjects in the format "Outage - [six-character code]". Senders also simulate official notifications, with names such as "Outage Notification" and "Service Health", accompanied by specific identifications for each organization.

Microsoft identified three domains used to send messages: moments-notice[.]com, planetmaison[.]com and newbooker[.]com. The emails contain links that pass through the SendGrid service, used to track clicks, before redirecting users to the reallifeaccounting[.]com domain.

Similar messages were sent to organizations across different sectors in the United States.

Objective is to steal data

The activity presents characteristics of phishing, a type of scam in which criminals pretend to be trusted companies or institutions to deceive victims and obtain information, such as passwords and access data.

Microsoft, however, emphasizes that it has not yet confirmed whether user credentials were collected or malicious programs (malware) were distributed through the campaign.

To identify potential victims, the company recommends that security teams investigate suspicious messages and the links included in them. One of the recommended tools is Microsoft Defender for Office 365, which allows you to examine emails and check whether users have clicked on potentially dangerous addresses.

The company also recommends checking the Safe Links configuration, a feature that analyzes links when they are accessed and offers protection against malicious addresses.

Finally, the guidance is that companies investigate possible employee interactions with messages and confirm any Microsoft 365 interruptions directly in the service's official administration center, instead of relying on links received by email.