Microsoft 365 Outage: Caution Advised as Cybercriminals Look to Exploit Service Disruption
A global outage affecting Microsoft’s suite of services, particularly Exchange Online and Outlook, has recently emerged, causing significant disruption for businesses and individuals reliant on these platforms. While the incident is not believed to have been caused by a cyber-attack, cybersecurity experts warn that this unexpected downtime may leave users vulnerable to new threats. Security teams are advised to adopt a heightened state of alertness as opportunistic cybercriminals are likely to take advantage of the ongoing chaos.
The outage leaves users struggling to reconnect to Microsoft 365 (M365) services, presenting a compelling opportunity for fraudsters to launch sophisticated phishing campaigns and deceptive technical support scams. Marie Wilcox, the Vice President of Market Strategy at Binalyze, a digital forensics firm, emphasized the significance of this issue. “Just because this outage wasn’t caused by a cyber-attack doesn’t mean attackers won’t seize the opportunity,” she stated.
In an official statement on November 13, Michelle McGuiness, the Australian National Cyber Security Coordinator, urged individuals to “remain vigilant and be cautious of unsolicited contact.” Cybercriminals are known to exploit times of uncertainty, and the current scenario is no different. Similarly, the UK’s National Cyber Security Centre issued a cautionary message advising the public to exercise extra caution regarding unexpected communications. Users are specifically warned against engaging with unsolicited calls and messages, especially those that include hyperlinks.
Threat actors are expected to send phishing messages that impersonate Microsoft, capitalizing on the confusion stemming from the service outage. Jake Moore, a Global Cybersecurity Advisor at ESET, noted that this type of disruption provides the perfect cover for cybercriminals to target organizations through impersonation calls, posing as IT support.
“Affected employees are literally waiting by the phone (or scrolling on social media!), and it only takes one employee to grant access to their machine for threat actors to gain entry, escalate their privileges, and wreak havoc on systems,” Moore warned.
Aiden Sinnott, Principal Threat Researcher at the Sophos Counter Threat Unit, echoed these sentiments, especially for businesses in sectors like finance or retail, which could be particularly vulnerable. Sinnott cautioned organizations to remain alert for requests demanding urgent action, sharing of personal information, and to be wary of clicking links sent via email or messages.
Microsoft has consistently been a major target for phishing campaigns launched by cybercriminals. In a Q3 update from cybersecurity firm Check Point, it was reported that Microsoft accounted for 33% of all brand phishing attempts, a significant increase from 23% in Q2. This trend underscores the likelihood that attackers will ramp up their efforts using the Microsoft brand during periods of service turbulence.
Binalyze’s Wilcox pointed out that many security teams may themselves be locked out of crucial tools during such disasters, such as Microsoft Defender XDR. This lack of access can hinder their ability to monitor suspicious activity. “When email services return, and workers begin to sift through the backlog, they will be particularly susceptible to trusting messages appearing to come from Microsoft—especially counterfeit security updates,” she noted.
Furthermore, Wilcox raised concerns about how easy it is for suspicious activities to fly under the radar during outages when alerts aren’t being monitored as they typically would be. “A suspicious sign-in or a new inbox forwarding rule is easy to overlook when everyone is focused on restoring email functions,” she commented.
Security experts recommend treating the outage as a security incident in its own right. Wilcox advised security teams to meticulously review sign-ins, mailbox rules, account modifications, and endpoint activities during the hours when visibility was diminished. She emphasized the importance of gathering evidence directly from devices rather than relying solely on the platform that experienced the downtime.
As for Microsoft, recovery efforts are underway, as noted in its latest service update. The company reported, “We are seeing early signs of stabilization, but service capacity has not yet returned to normal levels, and health remains variable as traffic is carefully reintroduced.”
In an increasingly digital world, such outages not only disrupt essential services but also create fertile ground for cybersecurity threats. As individuals and organizations work to regain access to their daily communications, the vigilance of security teams and end-users alike will be essential in mitigating potential risks during this chaotic period.