InfoSecBulletin Cybersecurity for mankind
Microsoft Azure Monitor is being misused in a new phishing scheme that makes bad emails seem real. Attackers are using the service to send back phishing emails that look like real Microsoft security warnings.
Threat actors are pretending to be the Microsoft Security Team in fake billing emails. These emails warn users about fake charges and urge them to call a number to fix the problem. The approach relies on urgency, pushing victims to act quickly without verifying the message through official channels.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
How the Azure Monitor phishing attack works
Attackers create Azure Monitor alerts with custom malicious descriptions
Alerts are triggered by common activities such as invoices, orders, or payments
Emails are sent to attacker-controlled mailing lists, then forwarded to victims
This preserves authentic Microsoft headers and trusted delivery paths
This method allows phishing emails to be sent from a real Microsoft address ([email protected]) and pass SPF, DKIM, and DMARC checks. This helps them get around many common email security filters.
Why is this attack especially dangerous?
This method makes phishing emails seem very real. They come from a trusted Microsoft address, which makes it more likely that people will trust them and do what they say.
Callback phishing brings more danger. Victims might share their login details, approve fake payments, or set up remote access tools while on the call. In businesses, this can cause bigger network problems.
What to watch for
Users should be careful with surprise billing alerts, especially if they have a phone number or urge quick action. Messages that tell you to call instead of using official Microsoft support should make you wary. Verifying alerts directly through official Microsoft portals remains the safest approach.
What users should do
Users shouldn’t depend only on the sender’s address when checking emails. Even messages that seem safe can be harmful if the service is misused.
Always check billing alerts at official Microsoft sites or your account.
Don’t call numbers from surprise emails.
This campaign shows how attackers misuse real platforms to get around security. It also talks about recent alerts about a serious SharePoint problem that is being exploited.
Threat actors are said to be selling a Windows Remote Desktop exploit. Meanwhile, Microsoft has given an emergency update, KB5084597, to fix RRAS vulnerabilities for remote code execution.
