Microsoft has issued a grave warning regarding an active phishing campaign that exploits the recent disruption of Microsoft 365 services on November 12. The nefarious attempt seeks to entice users into clicking on counterfeit email recovery links.
The phishing messages closely mimic official Microsoft service health notifications and reference the legitimate Exchange Online incident numbered EX1550543, thereby creating an illusion of authenticity tied to an actual business issue.
On November 13, Microsoft Threat Intelligence identified emails falsely claiming that messages held during the service outage would be permanently deleted within a mere 24 hours unless recipients acted to restore them.
This time constraint instigates a sense of urgency, particularly among employees anxious about missing critical customer communications, delayed financial transactions, or other time-sensitive business matters.
This warning follows a Microsoft 365 service interruption that impacted Exchange Online and various other cloud offerings.
While the phishing campaign leverages this disruption, it is crucial to distinguish it from the initial cause. Updates concerning the outage indicated no evidence that malicious activities prompted the service failure.
Ongoing Credential Theft Campaign
The fraudulent emails employ subject lines that adhere to the format “Outage – [six-character code].” The sender display names frequently incorporate organization-specific prefixes, concluding with phrases such as “Outage Notification” or “Service Health.”
Such particulars lend the messages an air of verisimilitude, while the genuine incident number offers recipients yet another reason to deem the request legitimate.
Microsoft has pinpointed three sender domains implicated in this scheme: moments-notice[.]com, planetmaison[.]com, and newbooker[.]com.
The embedded links utilize recipient-specific SendGrid click tracking prior to redirecting to a domain named reallifeaccounting[.]com, specifically the path /themelist0.html.
Similar phishing attempts have extended across various sectors within the United States, indicating a widespread operation rather than one limited to a particular entity.
In its public threat intelligence briefing, Microsoft characterized this activity as consistent with credential phishing, although it has not yet confirmed the actual collection of credentials or the deployment of malware.
This distinction is significant. While the observed emails and their redirects indeed align with phishing assessments, they do not conclusively demonstrate that passwords were appropriated or that devices were compromised.
Microsoft Threat Intelligence also noted that SendGrid links had appeared in an earlier credential phishing campaign reported by Cybersecuritynews.com.
While this past coverage elucidates how attackers exploit trusted email services, it does not establish a direct connection between the two campaigns, and Microsoft’s recent advisory does not identify the perpetrators responsible for these outage-focused messages.
To combat this threat, Microsoft advocates utilizing Defender for Office 365 Threat Explorer and Defender XDR advanced hunting features to scrutinize suspicious communications.
The EmailEvents, EmailUrlInfo, and UrlClickEvents tables serve as valuable resources for examining email behaviors, embedded links, and user interactions.
Investigators can leverage the identified sender domains, subject line patterns, and redirect destinations to refine their inquiries.
Organizations are encouraged to validate their Defender for Office 365 Safe Links policies. When configured correctly, Safe Links can provide real-time protection against malevolent URLs.
Moreover, Microsoft advises security teams to investigate any potential user interactions rather than solely relying on whether a suspicious message was delivered, since even a recorded click necessitates further investigation.
For end-users, the primary defense is straightforward: confirm any service disruptions directly through the Microsoft 365 admin center. An email referencing a legitimate outage number does not guarantee the safety of its recovery link.
Source link: Cybersecuritynews.com.
