• Home
• Fin tech

Cybersecurity firm Kaspersky has issued an urgent warning regarding cybercriminals exploiting the sudden outage that hit Microsoft 365 services on November 12 and 13, 2026. The company explained that hackers are capitalizing on the resulting confusion and the disruption of standard communication channels to launch intensive phishing campaigns aimed at stealing user credentials and Multi-Factor Authentication (MFA) codes.

Fertile Ground for Scammers

Leonid Bezvershenko, Senior Security Researcher at Kaspersky’s Global Research and Analysis Team (GReAT), emphasized that digital service outages create an ideal environment for attackers. During such disruptions, employees and customers are far more likely to trust messages that claim to offer outage updates or quick workarounds to restore access.

Deception and Impersonation Tactics

Bezvershenko revealed the various tricks hackers deploy under these circumstances, including:

Fake Messages: Sending emails and SMS texts impersonating Microsoft or technical support teams, featuring bogus password reset notifications and links leading to spoofed login pages designed to harvest data.

Voice Phishing (Vishing): Calling victims while posing as tech support agents to persuade them into granting attackers remote access to their devices.

Digital Misinformation: Spreading false service status updates across social media platforms and messaging apps to lure anxious users.

Why Do Attackers Succeed During Outages?

The security expert pointed out that requests for "re-authentication" or "account verification" appear logical and convincing to users during an actual service disruption. This significantly increases the success rate of these attacks, particularly in the absence of advanced security solutions capable of detecting anomalous behavior and blocking malicious redirects.

Prevention and Protection Steps

To avoid falling victim to these attacks, Kaspersky provided a set of recommendations for both organizations and individuals:

Establish an Official Source: Companies must designate a single, trusted official communication channel for sharing outage updates and educate employees against engaging with unsolicited support requests.

Never Share Sensitive Data: Constantly remind users that legitimate entities and service providers will never unexpectedly ask for passwords, MFA codes, or remote access permissions.

Strengthen Technical Oversight: Urge cybersecurity teams to monitor impersonation attempts, block spoofed domains, and enforce strict verification protocols, alongside utilizing reliable cybersecurity and anti-malware solutions on user devices.