Threat actors are sending fake “Outage” emails to Microsoft 365 users, claiming “(4) messages held” after the November 12–14 outage and demanding you click “RESTORE MESSAGES” before they are deleted within 24 hours. The link steals your password. Do not click anything — the emails are a phishing scam riding on the real outage (incident EX1550543).
Quick Fix Summary
- Problem: Threat actors are sending fake “Outage” emails to Microsoft 365 users, claiming “(4) messages held” after the November 12–14 outage and demanding you click “RESTORE MESSAGES” before they are deleted within 24 hours. The link steals your password.
- Fix: Do not click anything. The emails are a phishing scam riding on the real outage (incident EX1550543). Verify only in the Microsoft 365 admin centre Service Health page.
- What happened: Active phishing campaign observed November 12–13, 2026; Microsoft Threat Intelligence issued a warning on November 14. The emails cite the real incident ID to look genuine. Sender domains include moments-notice.com, planetmaison.com, and newbooker.com.
Technical Root Cause
| Error Code | Affected Version | Root Cause | Current Status |
|---|---|---|---|
| No error code — phishing email with subject “Outage – [six-character code]” | Microsoft 365 / Outlook users (74 countries in the outage); admins and end users | Threat actors exploiting the real Nov 12–14 Microsoft 365 outage (EX1550543) as a phishing theme; SendGrid click-tracking links redirect to reallifeaccounting.com/themelist0.html | Active campaign as of Nov 14, 2026 — Microsoft Threat Intelligence warning issued Nov 14 |
Step-by-Step: What to Do With a Fake Outage Email
Step 1 — Do Not Click, Do Not Reply, Do Not Open Attachments
Do not click “RESTORE MESSAGES” or any link in the email, do not open its attachments, and do not reply. The link is a credential-phishing page — it looks like a Microsoft sign-in and records whatever you type. Deleting the email is the safest action. The same November outage also broke Windows activation commands — see our Fix: slmgr.vbs 0x80041008 Invalid Parameter — but that real incident never asks you to click a link to restore messages.
Step 2 — Verify Only in the Microsoft 365 Admin Centre
If you are worried about held messages, check the real Service Health page in the Microsoft 365 admin centre — type the address yourself, never follow an email link. Microsoft never asks you to click a link to restore held messages. If the admin centre shows no held messages, there are none.
Step 3 — Spot the Tells
The scam has four tells: a subject line “Outage –” followed by a six-character code; a 24-hour deletion deadline to rush you; sender domains like moments-notice.com, planetmaison.com, or newbooker.com; and a display name built from your org’s prefix plus “Outage Notification” or “Service Health”. Real quarantine digests come only from quarantine@messaging.microsoft.com with the subject “Microsoft 365 security: You have messages in quarantine” — anything else claiming to be one is fake.
Step 4 — Admins: Check Defender and Entra ID Logs
Admins should check Defender for Office 365 Threat Explorer and Defender XDR advanced hunting — tables EmailEvents, EmailUrlInfo, and UrlClickEvents — and review Entra ID sign-in logs from November 12 for unusual logins. That shows who received the email and who clicked. The same Patch Tuesday also broke Word printing — see our Fix: Word Won’t Print After November Update — so check your whole fleet, not just one mailbox.
Step 5 — If You Already Clicked and Entered a Password
Change your password immediately from the real Microsoft 365 sign-in page — never from the email link — turn on multi-factor authentication if it is off, and tell your IT admin right away so they can check Entra ID sign-in logs for your account. Speed matters: a stolen password is used within hours, not days.
If your organisation manages your Microsoft tools, watch for another November breakage: VS Code 1.146 from the snap store can’t load managed settings at all — its libcrypto needs GLIBC 2.38. See Fix: VS Code 1.146 Won’t Load Managed Settings.
FAQ
I clicked the link — what now?
If you entered your password, change it immediately from the real Microsoft 365 sign-in page (never from the email link), enable multi-factor authentication if it is off, and tell your IT admin — they should check Entra ID sign-in logs from November 12 for unusual logins.
How do I tell the fake from a real Microsoft message?
Real quarantine digests come only from quarantine@messaging.microsoft.com with the subject ‘Microsoft 365 security: You have messages in quarantine’. The scam uses sender domains like moments-notice.com, planetmaison.com, and newbooker.com, and pressures you with a 24-hour deletion deadline.
Did the real Microsoft 365 outage cause this?
No — the outage was real (incident EX1550543, November 12–14), but the emails are a scam riding on it. Microsoft never asks you to click a link to restore held messages. Check the real Service Health page in the Microsoft 365 admin centre instead.
Sources: Field Effect, “Microsoft 365 outage theme” phishing report, November 13–14, 2026; Vijilan, November 14, 2026; Economic Times, November 13–14, 2026.
Verified by DebugRadar Engineering — Tested on Production Environments
DebugRadar’s engineering team tracks this issue against the vendor’s official status page and reproduces the reported failure before publishing. If the vendor resolves it, we update the guide — check the status links above for the latest state.
1 thought on “Fix: Fake Microsoft 365 Outage Emails Stealing Passwords”