Fake Microsoft shutdown email doing the rounds

You could receive an email with the subject line "Your Account Is Scheduled for Permanent Deletion" that appears to come from Microsoft New Zealand Limited. It is dressed up like a Microsoft 365 account or invoice notice, using Auckland address details to look legitimate, and is designed to pressure you into reviewing your account or taking urgent action before it is supposedly removed.

What gives it away is that the sender is not a trusted Microsoft domain at all, it is haz-mas.com, a newly registered domain with no established history as a legitimate business sender. Some of the email checks appear to pass, which can make it look safe at a glance, but the sending profile does not line up cleanly and the message fails part of the authentication picture. That means the branding can look convincing while the actual sender remains untrusted. If you reply, your response may also be directed somewhere other than the organisation being impersonated.

The attacker is after your credentials, your reply, or any click that gets you into their workflow. If you engage, you could hand over your Microsoft 365 sign-in details, expose your mailbox, or give an attacker a foothold to target invoices, staff, and customers from inside your business.

This campaign has been observed circulating across multiple New Zealand organisations in the last day, so treat any Microsoft-themed deletion or billing message from an unfamiliar domain as suspicious until you have verified it independently.