InfoSecBulletin Cybersecurity for mankind
Microsoft Azure Monitor is being misused in a new phishing scheme that makes bad emails seem real. Attackers are using the service to send back phishing emails that look like real Microsoft security warnings.
Threat actors are pretending to be the Microsoft Security Team in fake billing emails. These emails warn users about fake charges and urge them to call a number to fix the problem. The approach relies on urgency, pushing victims to act quickly without verifying the message through official channels.
Brazilian health surveillance platform breach exposes 100K+ sensitive documents
Thousands of data centers are at risk of compromise due to a 22-year-old flaw
Bangladesh Launches (CIRS) and National ICT & Cyber Security Rating System (NRS)
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
How the Azure Monitor phishing attack works
Attackers create Azure Monitor alerts with custom malicious descriptions
Alerts are triggered by common activities such as invoices, orders, or payments
Emails are sent to attacker-controlled mailing lists, then forwarded to victims
This preserves authentic Microsoft headers and trusted delivery paths
This method allows phishing emails to be sent from a real Microsoft address ([email protected]) and pass SPF, DKIM, and DMARC checks. This helps them get around many common email security filters.
Why is this attack especially dangerous?
This method makes phishing emails seem very real. They come from a trusted Microsoft address, which makes it more likely that people will trust them and do what they say.
Callback phishing brings more danger. Victims might share their login details, approve fake payments, or set up remote access tools while on the call. In businesses, this can cause bigger network problems.
What to watch for
Users should be careful with surprise billing alerts, especially if they have a phone number or urge quick action. Messages that tell you to call instead of using official Microsoft support should make you wary. Verifying alerts directly through official Microsoft portals remains the safest approach.
What users should do
Users shouldn’t depend only on the sender’s address when checking emails. Even messages that seem safe can be harmful if the service is misused.
Always check billing alerts at official Microsoft sites or your account.
Don’t call numbers from surprise emails.
This campaign shows how attackers misuse real platforms to get around security. It also talks about recent alerts about a serious SharePoint problem that is being exploited.
Threat actors are said to be selling a Windows Remote Desktop exploit. Meanwhile, Microsoft has given an emergency update, KB5084597, to fix RRAS vulnerabilities for remote code execution.
