Microsoft 365 Outage Raises Risk of Phishing and Support Scams

The Microsoft 365 outage that disrupted services interacting with Exchange Online, notably Outlook, is not believed to be cyber-related, but it is expected to heighten security risk as attackers look to capitalise on the disruption. Infosecurity reports that criminals are likely to deploy phishing campaigns and fake support scams aimed at users and employees eager to reconnect to M365 services.

Marie Wilcox, VP of market strategy at Binalyze, warns that even without a cyber-attack causing the outage, attackers may exploit the uncertainty to their advantage.

Security authorities and researchers emphasise heightened vigilance during the outage window. The Australian National Cyber Security Centre urged people to be wary of unsolicited contact, while the UK’s National Cyber Security Centre advised caution around unexpected calls and messages, especially with links. Industry commentators, including Jake Moore of ESET and Aiden Sinnott of Sophos, warn that threat actors may pose as Microsoft staff or IT support and that employees could inadvertently grant access.

The article notes Check Point’s finding that Microsoft accounted for about one-third of brand phishing in Q3 2026, underscoring the heightened risk during the outage as systems return to normal. Microsoft’s status update at that time indicated ongoing recovery with stabilized signs but not full normal capacity.