InfoSecBulletin Cybersecurity for mankind
Microsoft Azure Monitor is being misused in a new phishing scheme that makes bad emails seem real. Attackers are using the service to send back phishing emails that look like real Microsoft security warnings.
Threat actors are pretending to be the Microsoft Security Team in fake billing emails. These emails warn users about fake charges and urge them to call a number to fix the problem. The approach relies on urgency, pushing victims to act quickly without verifying the message through official channels.
LastPass says hackers stole customer data via Klue, supply chain breach
New Apple Exploit Bypasses Boot Defenses, Possibly Affects Millions of iPhones Worldwide
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
How the Azure Monitor phishing attack works
Attackers create Azure Monitor alerts with custom malicious descriptions
Alerts are triggered by common activities such as invoices, orders, or payments
Emails are sent to attacker-controlled mailing lists, then forwarded to victims
This preserves authentic Microsoft headers and trusted delivery paths
This method allows phishing emails to be sent from a real Microsoft address ([email protected]) and pass SPF, DKIM, and DMARC checks. This helps them get around many common email security filters.
Why is this attack especially dangerous?
This method makes phishing emails seem very real. They come from a trusted Microsoft address, which makes it more likely that people will trust them and do what they say.
Callback phishing brings more danger. Victims might share their login details, approve fake payments, or set up remote access tools while on the call. In businesses, this can cause bigger network problems.
What to watch for
Users should be careful with surprise billing alerts, especially if they have a phone number or urge quick action. Messages that tell you to call instead of using official Microsoft support should make you wary. Verifying alerts directly through official Microsoft portals remains the safest approach.
What users should do
Users shouldn’t depend only on the sender’s address when checking emails. Even messages that seem safe can be harmful if the service is misused.
Always check billing alerts at official Microsoft sites or your account.
Don’t call numbers from surprise emails.
This campaign shows how attackers misuse real platforms to get around security. It also talks about recent alerts about a serious SharePoint problem that is being exploited.
Threat actors are said to be selling a Windows Remote Desktop exploit. Meanwhile, Microsoft has given an emergency update, KB5084597, to fix RRAS vulnerabilities for remote code execution.
