Abuse of Microsoft Azure Monitor alerting system in callback phishing campaigns
Summary
Hide ▲
Show ▼
Threat actors are abusing Microsoft Azure Monitor’s alerting functionality to deliver callback phishing emails that impersonate Microsoft Security Team billing alerts. The emails are sent via Azure’s legitimate platform using the [email protected] address and pass SPF, DKIM, and DMARC checks, increasing their credibility. Attackers craft alerts with phishing messages in the description field, targeting users with fake unauthorized charge warnings to prompt urgent callback to fraudulent support numbers. The campaign leverages easily triggered alert rules tied to billing, invoice, payment, and resource-related events, forwarding emails to victim lists while preserving original Microsoft headers and authentication results to bypass spam filters.
Timeline
-
21.03.2026 16:09 1 articles · 1h ago
Azure Monitor alert phishing campaign escalates with legitimate email delivery mechanism
Threat actors are exploiting Microsoft Azure Monitor’s alerting platform to send callback phishing emails that bypass email security controls. Emails originate from [email protected] and pass SPF/DKIM/DMARC validation, carrying phishing messages embedded in alert descriptions tied to billing and resource events. Targets receive fake billing alerts prompting urgent callback to fraudulent support numbers, with prior campaigns linked to credential theft and remote access compromise.
Show sources
- Microsoft Azure Monitor alerts abused in callback phishing campaigns — www.bleepingcomputer.com — 21.03.2026 16:09
Information Snippets
-
Azure Monitor alerting allows attackers to insert arbitrary phishing content into the alert description field, which is then delivered to targets via the legitimate [email protected] address.
First reported: 21.03.2026 16:091 source, 1 articleShow sources
- Microsoft Azure Monitor alerts abused in callback phishing campaigns — www.bleepingcomputer.com — 21.03.2026 16:09
-
Emails sent through this method pass SPF, DKIM, and DMARC checks, appearing as legitimate Microsoft communications despite being crafted by attackers.
First reported: 21.03.2026 16:091 source, 1 articleShow sources
- Microsoft Azure Monitor alerts abused in callback phishing campaigns — www.bleepingcomputer.com — 21.03.2026 16:09
-
Alert rules are triggered by conditions such as invoice payments, order processing, or resource spikes (e.g., DiskFull, MemorySpike), using themes designed to create urgency (e.g., a $389 Windows Defender charge).
First reported: 21.03.2026 16:091 source, 1 articleShow sources
- Microsoft Azure Monitor alerts abused in callback phishing campaigns — www.bleepingcomputer.com — 21.03.2026 16:09
-
Attackers configure alerts to send emails to mailing lists under their control, which then forward the messages to targeted victims while preserving original Microsoft headers and authentication results.
First reported: 21.03.2026 16:091 source, 1 articleShow sources
- Microsoft Azure Monitor alerts abused in callback phishing campaigns — www.bleepingcomputer.com — 21.03.2026 16:09
-
Callback phishing emails instruct recipients to call fraudulent support numbers (+1 864-347-2494, +1 864-347-4846), where prior campaigns have resulted in credential theft, payment fraud, or remote access software installation.
First reported: 21.03.2026 16:091 source, 1 articleShow sources
- Microsoft Azure Monitor alerts abused in callback phishing campaigns — www.bleepingcomputer.com — 21.03.2026 16:09