The Microsoft 365 outage on November 12–13, which disrupted its workplace tools, has created the kind of confusion and urgency that scammers are quick to exploit, says a security expert. 

When normal communication channels go down, employees and customers are far more likely to trust messages that appear to offer updates, workarounds or a quick way to restore access. For an organisation that has not implemented cybersecurity solutions to block malicious redirections or abnormal network behaviour, this situation can escalate into something far more serious than a brief workflow delay, says Leonid Bezvershenko, Senior Security Researcher at Kaspersky Great.

Threat actors can exploit incidents like this in several ways: they may send phishing emails or text messages posing as Microsoft or internal IT teams, issue fake password reset prompts, circulate bogus recovery links or direct users to cloned login pages built to steal credentials and MFA codes, says Bezvershenko. 

"Another potential scenario, is that attackers might use impersonated help-desk calls to request remote access or pushing fake status updates through social media, personal email or messaging apps. In the middle of a live outage a simple request to “re-authenticate” or “verify your account” can seem credible because it matches what users expect to see."

Organisations should direct employees and customers to one verified source for updates, warn them against unsolicited support and reinforce that legitimate providers will never ask for passwords, MFA codes or unapproved remote access. Security teams should also watch for impersonation attempts, move quickly to block lookalike domains where possible and make sure help-desk staff follow strict verification procedures. For end users, a good practice is to use reliable antivirus solutions to stay alerted and protected from such fraudulent attempts, recommends Bezvershenko. -TradeArabia News Service