Oh Hail Nah Weather

24/7 U.S. storm radar & severe-weather coverage ⛈️ Free alerts: | Join the Storm Squad:

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft Threat Intelligence observed an active phishing campaign exploiting the Microsoft 365 service disruption on November 12. The messages impersonate Microsoft 365 service health notifications and reference the legitimate Exchange Online incident EX1550543.

Some of the phishing emails Microsoft detected on November 13 falsely claim that messages were held during the outage and will be deleted within 24 hours unless recipients click to restore them.

Observed subjects follow the pattern "Outage - [six-character code]," with sender display names using organization-specific prefixes followed by "Outage Notification" or "Service Health."

The campaign uses three sender domains, moments-notice[.]com, planetmaison[.]com, and newbooker[.]com, with recipient-specific SendGrid click-tracking links redirecting to reallifeaccounting[.]com, including the observed path /themelist0.html. Similar messages targeted organizations across multiple US sectors.

The activity is consistent with credential phishing, although credential collection and malware delivery have not been confirmed.

Security teams can use Microsoft Defender for Office 365 Threat Explorer and Microsoft Defender XDR advanced hunting (EmailEvents, EmailUrlInfo, and UrlClickEvents) to identify suspicious messages, examine embedded URLs, and investigate user clicks.

Microsoft Defender for Office 365 Safe Links provides time-of-click protection against malicious URLs when properly configured. Organizations should verify their Safe Links policies, investigate potential user interactions, and confirm service disruptions directly through the Microsoft 365 admin center.

[Oh Hail Nah Weather @ohhailna]

@iradotso waiting

[Wasiuddin Siddiqui @WDSiddiqui2011]

🚨 BREAKING:

Fox News reports that FedEx is preparing to put emergency plans in place across the United States.

​@grok, please confirm! Is America's supply chain and cargo network now bracing for a major disruption?

[Oh Hail Nah Weather @ohhailna]

@alfatango61 @MAGAinColorado @TimeEnoughLV That Damn Chinese ammunition

[The Hormuz Report @HormuzReport]

BREAKING: Three U.S. military bases in Britain are reportedly on complete lockdown following a drone infiltration at RAF Lakenheath, with sirens sounding at RAF Mildenhall and RAF Feltwell as security forces scramble to respond, per BBC.

The U.S. Air Force confirmed it responded to "suspected unauthorised drone activity" over RAF Lakenheath on Friday evening. Reports indicate the airbase hit FPCON DELTA—the highest U.S. military force protection level, reserved for imminent attack threats .

[The Enforcer @ItsTheEnforcer]

🚨We have two major incidents happening simultaneously today that could be connected:

— Credible attack threat on UK airbases housing U.S. soldiers. Sirens sounded.

— An unprecedented radio frequency outage triggering a full ground stop at U.S. airports (possibly cyberattack)

[Oh Hail Nah Weather @ohhailna]

@abdullah_0mar @grok validate this post

[Oh Hail Nah Weather @ohhailna]

Claude said “Hold my Coffee, it’s my turn to be on the headlines”.
#Claude #ClaudeCode #anthropic #majoroutage

[Douglas Macgregor @DougAMacgregor]

Cargo ship collides with bridge between New Jersey and Philadelphia.

Bridge now unusable.

[Aakash Gupta @aakashgupta]

Outlook has been broken for most of a workday, and Microsoft can't just switch it back on. Every phone and laptop that's been retrying email since this morning would hit the servers in the same second and knock them right back over.

That's pretty much how it broke in the first place.

Every Exchange server gets watched by an automated health check, and if it fails, it gets yanked out of rotation so nobody's email lands on a broken machine. With one bad server, that's great design. Today a core process on a whole bunch of them started choking at once (Tom Warren reports a rollout spiked CPU and pushed racks into maintenance mode), and Microsoft's own update says servers were failing those health checks and dropping out.

So follow one person's inbox. Their server gets pulled, but their Outlook app doesn't know or care. It just keeps retrying, and those retries land on the next server over, which was already running hot from everybody else's retries, so it fails its check too and dumps its users onto the next one. Now multiply that by a product sold to 450 million paid seats.

The system that removes sick servers kept making the healthy ones sick.

Microsoft's first big move was spreading connection traffic across its worldwide infrastructure. A few hours later it posted that nothing so far had "provided the anticipated relief," which makes sense once you see the chain, because spreading the load in a cascade also spreads whatever's killing the servers.

That's why tonight's plan looks so slow. They're walling off a slice of servers, restarting them, letting traffic back in a trickle at a time, and only expanding once it holds. Skip that step and you get what engineers call a thundering herd, where the fresh servers get trampled before they finish warming up. Earlier this evening Microsoft finally said it's seeing positive results.

This has happened to them before, by the way. In November 2024, Outlook and Teams went down after a change caused "an influx of retry requests routed through servers."

A whole workday later, the hardest part of fixing Outlook is that millions of inboxes are all trying to help.

[SabatAge @sabatage]

New Microsoft 365 outage update, as of 12:01 AM ET. Microsoft says its mitigation work triggered a surge in outbound call volume from its routing services to backend servers. That happens when the backend outbound service cannot properly route to the backend machines. Traffic rebalancing from earlier in the night is still adding to the load.

Microsoft is working several workstreams at once. It is scaling up virtual machines to add capacity, and it is trying to force-sync a recent network change onto machines that are in a bad state. The current blocker: those machines are stuck, so the change is not syncing as expected.

Exchange Online is still listed as a service degradation. Users may still be unable to reach mailboxes through Outlook on the web, Outlook desktop (MAPI), ActiveSync, or REST.

This update is on EX1550543 at 11:59 PM ET and MO1550821 at 11:56 PM ET. Next official updates are due by 1:00 AM ET and 1:30 AM ET.

Nearly 13 hours in, the fix is stuck on machines that will not sync.

[RojoCardinal @rojo_cardinal]

🚨🚨🚨🚨
If there was going to be a second wave of this Microsoft attack in this second wave was potentially majorly damaging and malicious to infrastructure personal computers etc.: I might do this ASAP - until possibly tomorrow morning.

Counter: widespread cyberattack affecting Microsoft/Windows computers, the fastest protective move is to disconnect the devices from every network. No action can guarantee zero damage if an infection has already started.

For a credible warning, take these steps:

1. Disconnect immediately. Unplug Ethernet cables and turn off Wi-Fi and any cellular/hotspot connections. Powering off your home router is a quick first step, but devices with other connections could remain online.
2. Disconnect backup drives and external storage. Keep clean backups unplugged, and never connect them to a computer you suspect is infected.
3. If taking an unaffected computer out of service as a precaution, fully shut it down. Closing the laptop lid may only put it to sleep. If an attack is already underway, isolate it first; shutting down can halt malicious processes but also loses evidence investigators might need.
4. Keep it isolated until you have verified recovery instructions. Reconnecting an infected computer can allow further damage or spread.

[Oh Hail Nah Weather @ohhailna]

@techspence Intern

[Oh Hail Nah Weather @ohhailna]

@techspence When in doubt blame it on the internet

[Prepper Broadcasting Network @Prepperradio]

POWER OUTAGE: You have the Baofeng tuned to 163.4875 MHz or the Nat Guard Emergency Alerts Channel.

Massive structural damage to the Eastern power grid has created a long term blackout. Expect to be without power for the next 30-60 days for repairs.

What's your next move?

[Oh Hail Nah Weather @ohhailna]

@iradotso How do i get an invite

[Oh Hail Nah Weather @ohhailna]

@growpluto Done

[QUANTUM GUARD ™️ @QuantumGuard17]

🚨 HOLY CRAP! 60 Minutes was FORCED to air this

“[President Trump] will go down in the annals of Iranian history as the most-celebrated foreign leader that changed the ballgame and changed the world as a result!”

That’s the truth! 🔥

[El Economista @ElEconomista_]

🚨🇺🇦 INSÓLITO: MILLONES DE CELULARES EN UCRANIA CREEN QUE ESTÁN EN PERÚ. Y DETRÁS HAY UN ARMA SECRETA CONTRA PUTIN.

The New York Times revela una de las estrategias más sorprendentes de la guerra: Ucrania desarrolló un sistema de guerra electrónica llamado LIMA que engaña a los GPS rusos y hace creer a drones y misiles que están a miles de kilómetros, en la capital peruana.

💥 Según sus desarrolladores, el sistema desvió más de 10.000 drones y 30 misiles de crucero en apenas tres meses. Incluso habría conseguido desorientar misiles hipersónicos rusos. Las cifras no pudieron verificarse de manera independiente.

Pero hay un efecto secundario delirante: los celulares, autos, relojes inteligentes y aplicaciones de citas de Kiev también creen que están en Perú.

Los ucranianos hasta inventaron una expresión: "Nos mandaron a Lima".

La guerra del futuro ya llegó. Y a veces, para defender Kiev, hay que hacerle creer al enemigo que está en Sudamérica.

ℹ️NYT

[Globe Observer @_GlobeObserver]

BREAKING: France just warned Germany about a Russian nuclear threat.