TL;DR: A convincing phishing scam is sending fake billing and security warnings through Microsoft’s own Azure Monitor service. The emails come from a real Microsoft address, pass your spam filters, and push you to call a scam phone number. If you get one, do not call. Log in to Azure directly through your browser to check, or ask your IT provider before you act.
A new phishing scam is fooling people because it does not look like phishing at all. The email appears to be a real alert from Microsoft Azure. It arrives from a genuine Microsoft address, it lands in your inbox without being flagged, and it warns about a billing problem or suspicious activity on your account. Nothing about it looks off, which is exactly why it works.
Azure Monitor is a real Microsoft tool that businesses use to keep an eye on their cloud systems. It tracks performance, spots problems, and sends alerts when something needs attention. If your company runs anything in Microsoft Azure, these notifications are a normal part of the day. So when one shows up saying there is an unexpected charge or a suspended account, most people do not think twice. That trust is the whole point of the attack.
Why is this Azure alert scam so hard to spot?
Because the email is genuinely sent through Microsoft’s own system, not faked from a lookalike address. Most phishing emails come from a slightly wrong domain or a sender you can catch with a careful look. This one comes straight from [email protected], a real Microsoft address, so the usual warning signs are simply not there.
The attackers are not pretending to be Microsoft. They are using Microsoft’s real infrastructure to deliver the message. Security researchers at TechRadar confirmed that because these alerts come from a trusted Microsoft domain, they slip past most email protection services and drop right into inboxes. When your eyes and your spam filter both say the email is legitimate, that is a dangerous combination. This is exactly the kind of threat that regular security awareness training is built to catch.
How the Azure Monitor scam actually works
Azure Monitor lets anyone create custom alerts that fire on simple triggers, like a new invoice or activity on an account. Whoever sets up the alert can also write the message that gets sent out. Attackers take advantage of that freedom in a few quiet steps.
First, they set up an alert rule with a basic trigger. Then they write their own warning message in the alert description, usually a fake billing problem, an unauthorized charge, or an account suspension notice, along with a phone number to call. Finally, they point the alert at a mailing list they control and set it off. The result is an email that looks completely legitimate, because in the technical sense it is. It really did come from Microsoft’s system. Only the words inside it were written by a scammer.
The goal is almost always the same: get you to call the phone number. This style of attack is called callback phishing, where the trap is not a bad link but an urgent request to pick up the phone. Once you call, the person on the other end tries to talk you into sharing account details, making a payment, or installing software that hands them remote access to your computer.
Why do these emails get past your spam filter?
They pass every technical check a spam filter runs, because they are real Microsoft emails. Filters look at whether a message truly came from the domain it claims, using behind-the-scenes checks like SPF, DKIM, and DMARC. A normal phishing email fails those checks. An Azure Monitor alert passes all of them, because it genuinely originated from Microsoft’s servers.
That is what makes this scam different from the phishing most tools are built to stop. There is no forged sender to catch and no suspicious domain to block. Blocking the sender does not even help, since it is a legitimate Microsoft address you may actually need for real alerts. Strong email and spam protection still matters, but this scam is a clear reminder that no filter catches everything, and a trained, skeptical team is the layer that closes the gap.
What should you do if you get one?
Stop and verify before you do anything, especially before you call any number in the email. Urgency is the scammer’s main tool, so the moment an email pressures you to act fast, that is your signal to slow down rather than speed up.
Do not use any phone number or link in the message. Instead, open your browser and go straight to your Azure account by typing the address yourself, at portal.azure.com, rather than clicking anything in the email. If there is a real billing issue or alert, it will show up inside your account. If nothing is there, the email was a scam. And if you are not completely sure, ask your IT provider to check before you take any action. A good managed IT partner can confirm whether an alert is real in a few minutes, which is far cheaper than the cost of calling a scammer.
Why phishing keeps getting harder to spot
The old advice about watching for spelling mistakes and clumsy formatting no longer holds up. Today’s phishing is often polished, well-timed, and delivered through systems your team already knows and trusts. Attackers have learned that earning your trust is easier than breaking through your security controls.
We have seen this playbook before with other trusted names. A few years ago, scammers ran similar campaigns through PayPal invoices and Google tools. The delivery service changes, but the idea stays the same: take a platform people already trust and let it carry the scam past the defenses. That trend is exactly why awareness matters more than ever, and why a moment of healthy skepticism is one of the strongest security tools your business has.
The takeaway is simple. A legitimate-looking email is not always legitimate. When something asks you to act urgently, especially to call a number or share information, pause, verify through a channel you trust, and ask questions before you act. If you are not confident your team would catch a scam like this one, reach out to our team and we will help you close the gap.
Worried your team might fall for this?
The scams slipping through today are the polished ones that look exactly like the emails your team sees every day. Z-JAK Technologies can train your staff to spot callback phishing and other modern tricks, and tighten the settings that reduce how many reach them in the first place. Get in touch for a security awareness check and give your team the confidence to pause and verify.
Frequently Asked Questions
Is an email from [email protected] always safe?
No. That is a real Microsoft address, but attackers can trigger Azure Monitor alerts that send from it with their own scam message inside. The email itself is technically genuine, while the warning and phone number in it are written by a scammer. Never treat the sender address alone as proof that a message is safe.
What is callback phishing?
Callback phishing is a scam that pushes you to call a phone number instead of clicking a link. The email creates urgency, often a fake charge or account problem, so you call the number in a hurry. On the call, the scammer tries to get account details, a payment, or remote access to your device. It sidesteps link-based defenses because there is no malicious link to catch.
Why don’t spam filters catch these Azure alerts?
Because they are real Microsoft emails sent from Microsoft’s own system. Spam filters check whether a message truly came from the domain it claims, and these alerts pass every one of those checks. There is no forged sender or suspicious domain to flag, so the email lands in the inbox looking completely normal.
What should I do if I get a suspicious Azure alert?
Do not call the number or click any link. Open your browser, type in the Azure portal address yourself, and log in to check for real alerts. If nothing shows up in your account, the email was a scam and you can delete it. When in doubt, forward it to your IT provider to verify before you act.
How can I tell a real Azure alert from a fake one?
A real alert reflects something happening in your actual Azure account, so it will match a change or event you can see when you log in directly. Fake ones push urgency, demand a phone call, or arrive when you do not even use Azure. The safest habit is to ignore the email’s contents entirely and verify inside your account.