InfoSecBulletin Cybersecurity for mankind
Microsoft Azure Monitor is being misused in a new phishing scheme that makes bad emails seem real. Attackers are using the service to send back phishing emails that look like real Microsoft security warnings.
Threat actors are pretending to be the Microsoft Security Team in fake billing emails. These emails warn users about fake charges and urge them to call a number to fix the problem. The approach relies on urgency, pushing victims to act quickly without verifying the message through official channels.
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
How the Azure Monitor phishing attack works
Attackers create Azure Monitor alerts with custom malicious descriptions
Alerts are triggered by common activities such as invoices, orders, or payments
Emails are sent to attacker-controlled mailing lists, then forwarded to victims
This preserves authentic Microsoft headers and trusted delivery paths
This method allows phishing emails to be sent from a real Microsoft address ([email protected]) and pass SPF, DKIM, and DMARC checks. This helps them get around many common email security filters.
Why is this attack especially dangerous?
This method makes phishing emails seem very real. They come from a trusted Microsoft address, which makes it more likely that people will trust them and do what they say.
Callback phishing brings more danger. Victims might share their login details, approve fake payments, or set up remote access tools while on the call. In businesses, this can cause bigger network problems.
What to watch for
Users should be careful with surprise billing alerts, especially if they have a phone number or urge quick action. Messages that tell you to call instead of using official Microsoft support should make you wary. Verifying alerts directly through official Microsoft portals remains the safest approach.
What users should do
Users shouldn’t depend only on the sender’s address when checking emails. Even messages that seem safe can be harmful if the service is misused.
Always check billing alerts at official Microsoft sites or your account.
Don’t call numbers from surprise emails.
This campaign shows how attackers misuse real platforms to get around security. It also talks about recent alerts about a serious SharePoint problem that is being exploited.
Threat actors are said to be selling a Windows Remote Desktop exploit. Meanwhile, Microsoft has given an emergency update, KB5084597, to fix RRAS vulnerabilities for remote code execution.
