Filtered by tag: social engineering × Clear
Microsoft Warns of Active Password Stealing Attack Exploiting the Microsoft 365 Service Disruption
Matched: health
Microsoft warned of a phishing campaign exploiting the November 12 Microsoft 365 outage. Emails impersonate service health notices, cite real incident ID EX1550543, and claim messages will be deleted within 24 hours unless recipients click a recovery link. Three sender domains were identified, with links redirecting through SendGrid to a suspicious site. Microsoft recommends verifying disruptions via the admin center and reviewing Safe Links policies.
Phishers quick to exploit extended M365 outage
Matched: health
During a recent Microsoft 365 outage, phishers quickly sent fake service health notifications warning users their emails were being held and would be deleted unless they clicked a link to restore access. The emails impersonated Microsoft's legitimate outage alerts, exploiting user anxiety during the disruption to steal credentials. Users are urged to verify alerts only through official Microsoft channels.
Scammers Use Microsoft Azure to Host Fake Windows Security Alerts Seen at 80 Organizations
Matched: health
Scammers are abusing Microsoft Azure to host fake Windows security alerts tricking users into calling fraudulent support numbers. Between March and October 2026, the same scam kit reached users at 80 organizations via malicious ads on legitimate websites. The pages use JavaScript to dynamically assign phone numbers and track campaign performance. Infrastructure clues point to Mandarin-speaking developers. Callers risk being manipulated into installing remote-access software or surrendering money.
Fake Microsoft Security Scan Tells You to Remove Antivirus—Then Scammers Ask for Remote Access
Matched: health
Scammers are running fake Microsoft-branded security scan websites that display fabricated system warnings and artificially low security scores to frighten visitors. The sites instruct users to uninstall their antivirus software, then collect personal and banking details through a form before redirecting victims to await a callback. During that call, operators request remote access to complete a fake refund, giving criminals direct control of the device. Malwarebytes identified 11 related sites sharing one server.