Microsoft Azure Monitor alerts abused in callback phishing campaigns
Recorded: March 21, 2026, 3 p.m.
| Original | Summarized |
Microsoft Azure Monitor alerts abused for callback phishing attacks News Featured Trivy vulnerability scanner breach pushed infostealer via GitHub Actions Microsoft Azure Monitor alerts abused for callback phishing attacks Musician admits to $10M streaming royalty fraud using AI bots FBI links Signal phishing attacks to Russian intelligence services Varonis Atlas: Securing AI and the Data That Powers It Microsoft Exchange Online service change causes email access issues Block ads and trackers on 9 devices for only $16 in this deal FBI warns of Handala hackers using Telegram in malware attacks Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityMicrosoft Azure Monitor alerts abused for callback phishing attacks Microsoft Azure Monitor alerts abused for callback phishing attacks By Lawrence Abrams March 21, 2026 Microsoft Azure Monitor alerts are being abused to send callback phishing emails that impersonate warnings from the Microsoft Security Team about unauthorized charges on your account. Microsoft Azure Monitor alert used in a callback phishing scamSource: BleepingComputer Authentication-Results: relay.mimecast.com; The threat actors are conducting this campaign by creating alerts in Azure Monitor for easily triggered conditions, such as new orders, payments, generated invoices, and other billing events. Description field when creating an Azure Monitor alertSource: Microsoft Red Report 2026: Why Ransomware Encryption Dropped 38% Related Articles: Alert Lawrence Abrams Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Popular Stories Microsoft: March Windows updates break Teams, OneDrive sign-ins CISA orders feds to patch max-severity Cisco flaw by Sunday Trivy vulnerability scanner breach pushed infostealer via GitHub Actions Sponsor Posts Secure your AI agents without sacrificing speed. AI is a data-breach time bomb: Read the new report Are refund fraud methods targeting your brand? You can monitor the underground for these threats. Cyber resilience without the complexity. Join Zero Networks to stop lateral movement fast. Overdue a password health-check? Audit your Active Directory for free Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Microsoft Azure Monitor alerts are being exploited in a sophisticated callback phishing campaign. According to a report by Lawrence Abrams for BleepingComputer, adversaries are abusing the legitimate Azure Monitor platform to send fraudulent alerts resembling Microsoft Security Team notifications regarding unauthorized charges on user accounts. This tactic leverages the trust associated with Microsoft’s services to bypass user caution. The core of the attack involves creating custom alerts within Azure Monitor that trigger based on common billing events, such as new orders or invoice activity. These alerts then generate emails, mimicking legitimate Microsoft communications, that instruct recipients to contact a provided phone number to resolve the issue. These emails utilize the azure-noreply@microsoft.com email address, passing SPF, DKIM, and DMARC authentication checks, thereby enhancing their credibility and facilitating their passage through standard spam filters. The attackers are specifically targeting alert rules related to invoices and payments, crafting messages that create a sense of urgency – in this instance, a fabricated $389 charge from Windows Defender – to pressure victims into immediately contacting the scammer’s phone numbers. The campaign employs multiple alert categories to maximize its effectiveness and evade detection. The utilized alert rules include those related to order payments and invoice processing events. The emails are designed to appear authentic, preserving the original Microsoft header information and authentication results, to amplify the deception. This intricate approach demonstrates a strategic understanding of Microsoft’s monitoring infrastructure and security protocols. The potential outcome of such interactions is often the compromise of user credentials, leading to financial fraud, or the installation of malware via remote access tools. Given the enterprise-oriented nature of these emails, it is hypothesized that the ultimate goal of the attack is to gain initial access to corporate networks for subsequent, more targeted attacks. Users are strongly advised to exercise extreme caution when receiving any Azure or Microsoft alerts that include a phone number or request immediate action concerning billing issues, treating them with heightened suspicion. |