InfoSecBulletin Cybersecurity for mankind
Microsoft Azure Monitor is being misused in a new phishing scheme that makes bad emails seem real. Attackers are using the service to send back phishing emails that look like real Microsoft security warnings.
Threat actors are pretending to be the Microsoft Security Team in fake billing emails. These emails warn users about fake charges and urge them to call a number to fix the problem. The approach relies on urgency, pushing victims to act quickly without verifying the message through official channels.
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
How the Azure Monitor phishing attack works
Attackers create Azure Monitor alerts with custom malicious descriptions
Alerts are triggered by common activities such as invoices, orders, or payments
Emails are sent to attacker-controlled mailing lists, then forwarded to victims
This preserves authentic Microsoft headers and trusted delivery paths
This method allows phishing emails to be sent from a real Microsoft address ([email protected]) and pass SPF, DKIM, and DMARC checks. This helps them get around many common email security filters.
Why is this attack especially dangerous?
This method makes phishing emails seem very real. They come from a trusted Microsoft address, which makes it more likely that people will trust them and do what they say.
Callback phishing brings more danger. Victims might share their login details, approve fake payments, or set up remote access tools while on the call. In businesses, this can cause bigger network problems.
What to watch for
Users should be careful with surprise billing alerts, especially if they have a phone number or urge quick action. Messages that tell you to call instead of using official Microsoft support should make you wary. Verifying alerts directly through official Microsoft portals remains the safest approach.
What users should do
Users shouldn’t depend only on the sender’s address when checking emails. Even messages that seem safe can be harmful if the service is misused.
Always check billing alerts at official Microsoft sites or your account.
Don’t call numbers from surprise emails.
This campaign shows how attackers misuse real platforms to get around security. It also talks about recent alerts about a serious SharePoint problem that is being exploited.
Threat actors are said to be selling a Windows Remote Desktop exploit. Meanwhile, Microsoft has given an emergency update, KB5084597, to fix RRAS vulnerabilities for remote code execution.
