USU InfoSec Team Warns of Phishing Attempts Tied to Microsoft 365 Outage

Editor’s note: This message from USU’s Information Security Team was emailed to all employees Friday afternoon.

Following yesterday’s Microsoft 365 outage, phishing emails are circulating posing as outage notifications. One came in this morning claiming messages were “held after the outage” and included a “Restore Messages” button. Our email filter has since removed it from USU mailboxes, but similar messages are likely over the next few days, and some may get to your USU email.

What to watch for:

Sender is not a usu.edu or microsoft.com address, even if the display name says “USU” or “Microsoft.”
Claims that messages, files, or your account were affected by the outage and need to be “restored” or “released.”
Urgency, such as content being deleted within 24 hours.
A button or link that asks you to sign in.

If you receive a message like this, do not click the link. Report it using the shield icon in the Outlook toolbar, then delete it.

If you clicked the button and entered your password, change your password immediately and contact the Service Desk at servicedesk@usu.edu.

A few general reminders related to phishing attacks:

Neither USU IT nor Microsoft will email, text, or call you unprompted to “restore” your account or messages.
Don’t click links in unexpected messages about service restoration. Open Outlook or Teams directly instead.
Never share your password or MFA codes with anyone, including someone claiming to be from IT.
Verify unexpected requests through the Service Desk, not through contact details in the message.

Current examples are posted at usu.edu/infosec/phish-bowl. Join the InfoSec conversation on Slack in #security_talk (usu.slack.com/archives/C8BHA69SS).

Thanks for helping keep USU accounts secure.

IT InfoSec Team

infosec.usu.edu

This message to All-Employees was authorized by William M. Plate JR., Vice President, University Marketing & Communications.