Microsoft Azure Monitor callback phishing campaign
Campaign
Summary
Hide ▲
Show ▼
A callback phishing campaign is abusing Microsoft Azure Monitor alerts to send fake billing warnings through legitimate Microsoft mail flow, making the messages more believable to recipients. The operation has been active over the past month and uses urgent notices about unauthorized charges to pressure people into calling attacker-controlled numbers. The trusted sender path and preserved authentication results raise the chance that the lure will bypass spam filters and user suspicion.
Related Happenings
QR code phishing surged across email threats in Q1 2026
Trend
H score73
First: 05.05.2026 09:35
Last: 05.05.2026 09:35
Sources 1
About this happening:
Q1 2026 email-threat telemetry shows QR code phishing and CAPTCHA-gated phishing rising quickly, increasing the risk of credential theft across organizations....
QR code phishing surged across email threats in Q1 2026
TrendAbout this happening: Q1 2026 email-threat telemetry shows QR code phishing and CAPTCHA-gated phishing rising quickly, increasing the risk of credential theft across organizations....
Microsoft 365 mailbox-rule abuse rises across breached accounts in Q4 2025
Trend
H score6
First: 13.04.2026 18:00
Last: 13.04.2026 18:00
Sources 1
About this happening:
In Q4 2025, about 10% of breached Microsoft 365 accounts had malicious mailbox rules created within seconds of compromise, increasing persistence, data theft,...
Microsoft 365 mailbox-rule abuse rises across breached accounts in Q4 2025
TrendAbout this happening: In Q4 2025, about 10% of breached Microsoft 365 accounts had malicious mailbox rules created within seconds of compromise, increasing persistence, data theft,...
Russian state-sponsored hackers' ongoing Signal and WhatsApp phishing campaign
Campaign
H score38
First: 09.03.2026 23:24
Last: 09.03.2026 23:24
Sources 1
About this happening:
An ongoing Russian intelligence-linked phishing campaign is targeting Signal and WhatsApp users and has evolved from stealing verification codes and account PINs t...
Russian state-sponsored hackers' ongoing Signal and WhatsApp phishing campaign
CampaignAbout this happening: An ongoing Russian intelligence-linked phishing campaign is targeting Signal and WhatsApp users and has evolved from stealing verification codes and account PINs t...
Latest development: 27.06.2026 01:06
FBI and CISA warn that the Russian intelligence services-linked Signal phishing campaign has evolved from stealing verification codes, account PINs, and linked-device access to eliciting victims' Backup Recovery Keys through impersonated Signal support messages. If a target provides the key, attackers can restore Signal's Secure Backups on their own devices and read historical messages, including private and group conversations, while the campaign continues to target high-intelligence-value individuals.
Tycoon 2FA-Storm-1747 ecosystem shift changes threat-actor operations
Threat Actor Meta
H score82
First: 05.03.2026 08:51
Last: 05.03.2026 08:51
Sources 1
About this happening:
Tycoon2FA has shifted from a subscription-based PhaaS and AitM credential harvester into a more resilient campaign that now uses device-code phishing against Mic...
Tycoon 2FA-Storm-1747 ecosystem shift changes threat-actor operations
Threat Actor MetaAbout this happening: Tycoon2FA has shifted from a subscription-based PhaaS and AitM credential harvester into a more resilient campaign that now uses device-code phishing against Mic...
Latest development: 17.05.2026 17:43
eSentire says Tycoon2FA now uses device-code phishing to target Microsoft 365 accounts, with invoice-themed lure emails carrying Trustifi click-tracking URLs that redirect through Trustifi, Cloudflare Workers, obfuscated JavaScript layers, and a fake Microsoft CAPTCHA page before sending victims to microsoft.com/devicelogin. The kit also adds anti-analysis defenses, including detection of Selenium, Puppeteer, Playwright, and Burp Suite, plus blocks for security vendors, VPNs, sandboxes, AI crawlers, and cloud providers.
Global phishing and identity-compromise trend across Darktrace customers in 2025
Trend
H score61
First: 26.02.2026 17:00
Last: 26.02.2026 17:00
Sources 1
About this happening:
Darktrace telemetry showed a sharp rise in identity-driven phishing across its global customer base in 2025, with more than 32 million high-confidence phishing...
Global phishing and identity-compromise trend across Darktrace customers in 2025
TrendAbout this happening: Darktrace telemetry showed a sharp rise in identity-driven phishing across its global customer base in 2025, with more than 32 million high-confidence phishing...
Timeline
-
21.03.2026 16:09 2 articles · 3mo ago
Azure Monitor callback phishing campaign disclosed
Initial DisclosureA callback phishing campaign is abusing Microsoft Azure Monitor alert messages to impersonate Microsoft Security Team billing warnings, using urgent unauthorized-charge language, attacker-controlled phone numbers, and legitimate [email protected] delivery that passes SPF, DKIM, and DMARC checks.
Show sources
- Microsoft Azure Monitor alerts abused in callback phishing campaigns — www.bleepingcomputer.com — 21.03.2026 16:09
- Microsoft Azure Monitor alerts abused in callback phishing campaigns — www.bleepingcomputer.com — 21.03.2026 16:09