Cyber attack. Photo: Shutterstock Microsoft is publishing a cyber warning today (Saturday, November 14) following the identification of an active phishing campaign that exploits the glitch that occurred in Microsoft 365 services on November 12.
In an official announcement published by the company's threat intelligence division, Microsoft Threat Intelligence, it was stated that attackers are distributing emails that pretend to be official alerts about the status of the Microsoft 365 service, using real details of the outage to mislead users and get them to click on suspicious links.
The phishing messages include the event number EX1550543, related to disruptions in the Exchange Online service, in order to create the impression that it is a credible message from the company.
According to Microsoft, phishing messages identified starting on November 13th claim that emails have been stuck due to the glitch and that they will be deleted within 24 hours if the user does not take action to release them.
One of the announcements published by the company includes the following title in English:
"Action required: (4) messages held after the outage"
This means that action is required to release four messages that were stuck due to the error.
The body of the message claims that disruptions in the Exchange Online service prevented messages from being delivered to the user's mailbox.
Below, a prominent yellow button appears with the inscription “RESTORE MESSAGES,” inviting the recipient to click it to ostensibly prevent the messages from being deleted.
The company warns that this attempts to exploit the fear of losing important messages, especially after a real malfunction in its services.
As part of the investigation, Microsoft's Threat Intelligence Division identified three domains used to send the phishing messages:
-moments-notice[.]com
-planetmaison[.]com
-newbooker[.]com
Additionally, the company identified that the messages included unique links to recipients via the SendGrid click-tracking service, which redirected to another domain:
reallifeaccounting[.]com
One of the Internet routes identified as part of the campaign is:
/themelist0.html
According to Microsoft, the subject lines of the phishing messages include the word “Outage” followed by a six-character code.
The names of the senders are also tailored to the organizations to which the messages are sent, and incorporate phrases such as “Outage Notification” or “Service Health” to reinforce the impression that these are official notifications.
The company notes that similar messages have been sent to organizations from various sectors.
The company emphasizes that the pattern of activity is consistent with phishing attempts aimed at obtaining user identification information.
The concern is that a user who clicks on the link will be directed to a page designed to mislead them and make them provide sensitive information, including login details for corporate accounts.
However, the company clarifies that at this stage, the theft of login details or the distribution of malware has not actually been verified as part of the specific campaign.
That is, this is an active phishing attack that was detected by Microsoft, but the company is not confirming at this stage that the attackers were able to steal passwords or take over accounts.
After identifying the campaign, Microsoft recommends that information security teams use the Microsoft Defender for Office 365 Threat Explorer tool and the investigative capabilities of Microsoft Defender XDR to detect suspicious messages, inspect the links they contain, and investigate user clicks.
The company also emphasizes the importance of using the Safe Links mechanism, which provides protection against malicious web addresses at the time of clicking, when properly configured.
Additionally, organizations are advised to review their protection policies, investigate suspicious user interactions, and verify information about faults and disruptions directly through the official Microsoft 365 admin center.
Users who receive messages requiring them to restore emails following the incident are asked to avoid clicking on unfamiliar links and not provide login information.
In the background, on November 12, a malfunction occurred in Microsoft 365 services, including Exchange Online.
The event was recorded in the company's systems under the number EX1550543. According to a Microsoft Threat Intelligence announcement published today (Saturday, November 14), as early as November 13, phishing messages were identified that exploited the malfunction and pretended to be official company notifications.
The messages included real details about the disruption in order to convince users to click on suspicious links. Microsoft is now warning about the active campaign and is publishing technical details and instructions for identifying