While the global outage of Microsoft 365 services that interact with Exchange Online, significantly Outlook, is not believed to be cyber-related, security teams will need to be on high alert for threats related to the incident.
As the tech behemoth grapples with the fix, cybercriminals will be poised to take advantage of the chaos by launching a surge of convincing phishing campaigns and fake support scams designed to dupe individuals and employees desperate to reconnect to M365 services.
Marie Wilcox, VP of market strategy at digital forensics firm Binalyze, said, “Just because this outage wasn’t caused by a cyber-attack, doesn’t mean attackers won’t seize the opportunity.”
In an update on November 13, the Australian National Cyber Security Coordinator Michelle McGuiness warned people to “remain vigilant and be cautious of unsolicited contact” as cybercriminals often seek to take advantage of the uncertainty.
It is likely that threat actors will begin to send phishing messages, claiming to be the Microsoft brand in order to trick people in this time of uncertainty.
Speaking to Infosecurity, Jake Moore, Global Cybersecurity Advisor at ESET, said that this kind of disruption is the perfect excuse for cybercriminals to hit organizations with targeted calls posing as IT support.
“Affected employees are literally waiting by the phone (or scrolling on social media!), and it only takes one employee to grant access to their machine for threat actors to gain access, escalate their privileges and wreak havoc on systems,” he noted.
Aiden Sinnott, principal threat researcher at the Sophos Counter Threat Unit, said that affected businesses like banks and shops should be particularly vigilant.
“Be aware of requests for urgent action, sharing of personal information and avoid clicking on links sent via message or email,” he said.
Microsoft is one of the brands most leveraged by threat actors for phishing campaigns. In an October update, cybersecurity firm Check Point noted that in Q3 2026 Microsoft accounted for 33% of all brand phishing attempts, up from 23% in Q2 2026 and roughly four times the share of any other brand.
Defenders Should Treat Outage as Security Incident
Binalyze’s Wilcox said that many security teams themselves will have been locked out of tools they depend on to prevent trouble, for example Microsoft Defender XDR or important alerts pushed via Outlook.
She noted that when email services return and workers are beginning to clear the day’s backlog, this is when they will be most susceptible to trusting any messages that looks like they came from Microsoft – especially fake security updates.
During the outage period it will also be easy for suspicious activity to go unnoticed while alerts were not being monitored as usual.
“A suspicious sign-in or a new inbox forwarding rule is easy to miss when everyone is focused on getting email back,” she said.
“The wisest approach is for security teams to treat the outage window as an incident in its own right. That means going back over sign-ins, mailbox rules, account changes and endpoint activity from the hours when visibility dropped, and collecting evidence directly from devices rather than relying on the platform that was down,” Wilcox advised.
At the time of writing, Microsoft’s latest update said recovery efforts are ongoing across the impacted infrastructure. “We are seeing early signs of stabilization, but service capacity has not yet returned to normal levels and health remains variable as traffic is carefully reintroduced.”
Image credit: Mijansk786 / Shutterstock.com