Attackers Abuse Azure Monitor Alerts to Send Callback Phishing Emails
Summary
Attackers are using editable Azure Monitor alert descriptions and attacker-controlled mailing lists to send convincing callback phishing emails that pass SPF, DKIM, and DMARC checks. The messages impersonate Microsoft and claim urgent billing issues.
Key points
- Attackers create Azure Monitor alerts with editable descriptions containing callback phishing messages disguised as billing notices.
- The emails come from [email protected] and pass SPF, DKIM, and DMARC authentication checks.
- Alerts are configured for easily triggered conditions and sent to attacker-controlled mailing lists, which forward them while preserving Microsoft headers.
- A reported example claims a fake $389.90 Windows Defender charge and urges recipients to call a listed phone number.
- The article warns that callback scams can lead to credential theft, payment fraud, or remote-access software installation; corporate network access is a possible goal, not a confirmed outcome of this campaign.
- Users should be suspicious of Microsoft or Azure alerts demanding urgent action by phone and verify billing issues through official channels.
Article Details
- Event Type
- Callback phishing campaign abusing legitimate Microsoft Azure Monitor alerts to send fraudulent billing warnings.
- Impact
- Recipients are urged to call fraudulent phone numbers over a purported $389.90 Windows Defender charge. The article says calls in previous callback-phishing campaigns have led to credential theft, payment fraud, or remote-access software installation; this campaign may also be intended to gain initial access to corporate networks.
Vendors
Products
Azure MonitorThreat actors are abusing Microsoft Azure Monitor to send callback phishing emails that impersonate the Microsoft Account Security Team and warn of unauthorized billing charges.Windows DefenderThe campaign uses urgency—such as a fake $389 Windows Defender charge—to coax victims into calling numbers that can lead to credential theft, payment fraud, or remote access installations.