Microsoft Threat Intelligence has identified phishing emails that exploit the November 12 Microsoft 365 disruption, citing the genuine Exchange Online incident EX1550543 to make fake recovery instructions look credible.
In its public warning, Microsoft says messages detected on November 13 falsely threatened to delete held email within 24 hours unless recipients clicked to restore it. The lures imitate service-health notifications and use outage-themed subjects.
Recipient-specific SendGrid tracking links redirect to a third-party website. Microsoft describes targeting across multiple US sectors, but says neither credential collection nor malware delivery has been confirmed. Observing a phishing message or redirect does not establish a successful account compromise.
Field Effect separately reported detecting an outage-themed email on November 13 that copied a quarantine notification and linked its message-restoration button to a credential-harvesting page.
Microsoft recommends reviewing suspicious messages, links and user clicks through Defender tools, checking Safe Links policies, and confirming disruptions directly in the Microsoft 365 admin center. A correct incident reference should never be treated as proof that an emailed recovery link is legitimate.
