Microsoft Restores 365 Services Amid Warning of Phishing Campaigns

Microsoft has restored all 365 services following a multi-day outage caused by server instability. Simultaneously, the company warns users of an active phishing campaign exploiting the incident to target organizations for credential theft.

Microsoft Restores 365 Services Amid Warning of Phishing Campaigns

Microsoft has restored Microsoft 365 services to all remaining affected customers and regions following a multi-day disruption, while its cybersecurity team has warned of a phishing campaign exploiting the incident to target users with fraudulent service notifications.

The disruption, which began on November 12, affected access to Exchange Online mailboxes and email connectivity across multiple regions. In its latest update posted on X on Saturday, Microsoft 365 Status said it had completed efforts to address the underlying issue and restored services to the remaining impacted customers and regions.

Separately, Microsoft Threat Intelligence flagged an active phishing campaign that exploited the service disruption to trick users into sharing sensitive information. According to the cybersecurity team, the fraudulent emails impersonated Microsoft 365 service health notifications and referenced the legitimate Exchange Online incident, EX1550543. Some messages falsely claimed that emails had been held during the outage and would be deleted within 24 hours unless recipients clicked on a link to restore them.

The suspicious emails carried subject lines following the pattern "Outage - [six-character code]" and used sender display names containing organisation-specific prefixes followed by "Outage Notification" or "Service Health". Microsoft identified three sender domains associated with the campaign, including moments-notice[.]com, planetmaison[.]com and newbooker[.]com. The emails contained recipient-specific SendGrid click-tracking links redirecting users to reallifeaccounting[.]com. The company said the activity was consistent with credential phishing, although credential collection and malware delivery had not been confirmed.

The campaign targeted organisations across multiple US sectors. Microsoft advised security teams to use Defender for Office 365 Threat Explorer and Defender XDR advanced hunting tools to identify suspicious emails, examine embedded URLs and investigate potential user interactions. The phishing warning came as Microsoft continued recovery efforts following infrastructure instability that affected multiple regions. The company had earlier attributed the disruption to several servers becoming unexpectedly unavailable, resulting in elevated loads on the remaining infrastructure. Microsoft undertook server restarts, traffic redistribution and configuration changes to restore capacity. It also extended email timeouts to 48 hours to preserve delayed messages during the disruption. The company has advised organisations to verify Safe Links protection policies and confirm service-related notifications directly through the Microsoft 365 admin centre.