Azure Monitor is a legitimate Microsoft service that watches your cloud resources and emails you when something needs attention. That is exactly why threat actors have spent the past several months turning it into a phishing delivery system of their own, one where the message really does come from Microsoft’s mail servers, really does pass every authentication check a receiving server can run, and really does end with a phone number connected to a scammer instead of a link a filter can flag.
What Azure Monitor Alerts Are Supposed to Do
Azure Monitor lets any subscription owner create an alert rule that watches for a condition, a metric crossing a threshold, a resource state changing, a budget being exceeded, and fires a notification when that condition is met. The notification is handled by an action group, a list of recipients and channels the alert should reach, which can include an email address typed in directly by whoever configured the rule. When the alert fires, Azure Monitor’s own infrastructure generates and sends the email. The sender is genuinely [email protected], because it genuinely is Azure Monitor sending it.
Turning a Billing Alert Into a Phone Scam
The abuse does not require compromising Microsoft, your organization, or anyone’s account. An attacker only needs an Azure subscription, including a free or trial one they created themselves, with enough access to build an alert rule and its action group. Researchers at IRONSCALES documented one instance where the attacker created a resource group named pay-cbb33c4ab1 and configured a metric alert whose description field, normally reserved for operational text, was instead filled with fraudulent billing language. The attacker then added the target’s email address as a recipient in the action group and triggered the alert.
What arrives in the inbox is a real Azure Monitor notification, formatted the way Azure Monitor notifications are formatted, sent from the address Azure Monitor actually sends from. The only thing attacker-controlled is the text inside it.
The $459.90 Invoice That Was Never Sent by Billing
The message IRONSCALES caught claimed a transaction ID of PP456-887A-22B, a charge of $459.90 tied to a “Windows Defender” merchant descriptor, and a header reading “MICROSOFT CORPORATION BILLING AND ACCOUNT SECURITY NOTICE.” None of that is part of Azure’s standard alert template, which is precisely how the message got flagged, not by SPF, DKIM, or DMARC, all of which passed cleanly, but by behavioral detection noticing that Azure Monitor alerts do not normally talk about billing at all. The message carried no link. It carried two phone numbers, +1 (812) 266-1890 and +1 (812) 266-1510, neither of which appears on any official Microsoft support page. That is callback phishing, sometimes called TOAD, telephone-oriented attack delivery, and it is deliberately built to give a link scanner nothing to scan.
Why This Keeps Working Months Later
Researchers at Trustwave SpiderLabs first documented an active version of this campaign in March 2026, tracking attacker-built Azure Monitor alert rules carrying fake invoice and unauthorized-payment lures, with victims added directly to the action group tied to the malicious rule. Triskele Labs, in research led by analyst Adam Skupien, reached the same conclusion independently and published a specific fix: route Azure Monitor alert email only to designated operational mailboxes or groups, and quarantine it for everyone else. Months later, reports of the same pattern are still arriving, because the underlying gap that makes it possible, a cloud platform that will happily deliver attacker-written text to anyone an account holder lists as a recipient, has not been closed at the platform level.
Why DMARC Has Nothing to Say Here
DMARC, together with SPF and DKIM, answers exactly one question: is the domain in the message’s From header authorized to send this message. When Azure Monitor sends an alert from [email protected], the answer is unambiguously yes, because Microsoft’s own infrastructure is the one sending it. DMARC has no mechanism for asking who configured the alert rule, what account created it, or whether the text in the description field is a legitimate operational note or a fabricated invoice. Authentication verifies the pipe. It was never built to inspect what a legitimate sender lets an attacker pour through it.
What This Means for Your Program
Route Azure Monitor mail through a dedicated, monitored channel. If your organization uses Azure Monitor alerts, restrict which mailboxes can receive them and apply extra scrutiny, rather than letting any address an account holder types into an action group land directly in an inbox.
Train users to distrust phone numbers as much as links. Callback phishing exists specifically because organizations spent years training people to hover over links and check domains. A message with no link and a phone number instead should raise the same suspicion, not less.
Know what your legitimate alerts actually look like. Azure Monitor’s standard notification template does not include billing statements, transaction IDs, or urgent account security language. A deviation from the normal template is a stronger signal than the sending address, since the sending address will check out every time.
Do not expect DMARC enforcement to catch this. A strict p=reject policy on your own domain protects against someone spoofing you. It has no effect on a message that is genuinely from Microsoft, carrying content Microsoft never wrote.
Push for behavioral and content-based detection, not just authentication-based filtering. The only reason this campaign gets caught at all is that some defenders are looking at what an alert says relative to what alerts normally say, not just where it came from.
The Takeaway
Every layer of email authentication did exactly what it was designed to do in every one of these messages, confirmed that Azure Monitor sent them, because Azure Monitor did. The fraud lives entirely in a text field that a legitimate cloud service will format, sign, and deliver on an attacker’s behalf, provided the attacker can create even a free subscription. That is not a flaw in SPF, DKIM, or DMARC. It is a reminder that authenticating a sender and vetting the content that sender chooses to deliver were always two separate problems, and a platform as large as Azure will keep producing new ways to remind us of the difference.
Excello Mail gives you continuous visibility into your DMARC reports, so you can see exactly which sources are authenticating under your domain, even as attackers find new ways to make a legitimate platform carry fraudulent content on their behalf. Sign up for free to Excello Mail and put real monitoring behind the authentication layer you control.