Microsoft has warned of an active phishing campaign that is using the recent Microsoft 365 service disruption to target users with fake service notifications. The messages falsely claim that emails delayed during the outage will be permanently deleted unless recipients click a link to restore them.
Microsoft Threat Intelligence identified the campaign on 13 November 2026, a day after the widespread disruption affected Outlook, Teams and other workplace applications. The fraudulent emails refer to the genuine Exchange Online incident numbered EX1550543, an attempt to make the messages appear connected to Microsoft’s real service-health communications.
How the campaign is presented
The emails reportedly say that certain messages were held back during the outage and will be removed within 24 hours unless the recipient takes action. Their subject lines begin with the word “Outage” followed by a six-character code. The sender display names also include organisation-specific identifiers alongside phrases such as “Outage Notification” and “Service Health”.
Those details may make the messages look as though they came from an employer’s information technology team or an authorised Microsoft service administrator. The reported objective appears to be the theft of account credentials, although Microsoft has not confirmed whether the attackers successfully obtained passwords or delivered malicious software through the campaign.
What Microsoft has confirmed
The activity has so far been reported against organisations in multiple industries in the United States. The information provided by Microsoft does not identify Indian organisations or confirm that users in India were targeted. However, the use of a real Microsoft 365 incident reference and the threat of losing important work emails are designed to create urgency for recipients, regardless of where their organisation is based.
- The campaign impersonates Microsoft service-health communications.
- It refers to the genuine Exchange Online incident EX1550543.
- Recipients are falsely told that emails will be deleted unless they click a link.
- Microsoft has not confirmed successful password theft or malware delivery.
The campaign follows the 12 November 2026 Microsoft 365 service disruption, which made it difficult for businesses and individuals to access workplace applications and receive emails. By connecting the fraudulent messages to that real event, attackers are attempting to exploit uncertainty among users who may already be waiting for missing or delayed communications.
Why the incident matters to Microsoft 365 users
A service outage can make an unexpected notification appear credible, particularly when it includes a valid incident number and references an organisation’s own identity. A link presented as a way to recover email could instead lead to a page designed to capture Microsoft 365 sign-in details. The report does not state that Microsoft 365 itself was breached as part of this campaign, nor does it confirm that any credentials were taken.
Microsoft’s warning establishes that the messages are fraudulent and that the campaign is active. Users and administrators assessing an email connected to the outage should therefore distinguish between the genuine service disruption and unsolicited instructions that demand immediate action to prevent deletion of messages. The available report gives no indication of a software patch or service-side fix for recipients; the issue described is a social-engineering campaign rather than a confirmed Microsoft 365 system vulnerability.
