Phishers quick to exploit extended M365 outage

Resumen detallado

Fake service health notices threaten to delete "held" email unless recipients click to restore it.

Phishers have moved fast to exploit this week's Microsoft 365 outage, sending fake service health notices that attempt to exploit the global disruption.

Microsoft Threat Intelligence said it had observed an active campaign that impersonated Microsoft 365 service health notifications and referenced the genuine Exchange Online incident EX1550543.

Some of the emails Microsoft detected falsely claimed that email messages had been held during the outage and would be deleted within 24 hours unless recipients clicked to restore them.

Message subject headings followed the pattern "Outage - [six-character code]".

Sender display names used organisation-specific prefixes, followed by "Outage Notification" or "Service Health".

Such tailoring could make the messages harder to ignore, particularly in inboxes already full of genuine outage updates.

The campaign used three sender domains: moments-notice[.]com, planetmaison[.]com and newbooker[.]com.

Messages used a recipient-specific SendGrid click-tracking link, which redirected to reallifeaccounting[.]com. Microsoft cited the path /themelist0.html as one example.

Microsoft said similar messages targeted organisations across multiple US sectors.

Inicio del artículo, extracto de iTnews. Para leer el resto, abra el artículo en el sitio del medio.