This new scam doing the rounds is bit more convincing than most and looks like a genuine alert from Microsoft Azure Monitor.
It shows up in your inbox from a real Microsoft domain, so it doesn’t get flagged as suspicious.
That’s what makes it difficult to catch.
Azure Monitor helps businesses keep track of their systems.
It helps spot problems, track performance, and notify you when something needs attention.
For businesses using cloud services, particularly Microsoft Azure, these alerts are completely normal.
So, when an email arrives saying there’s a billing issue, suspicious activity, or a problem with your account, it doesn’t immediately raise alarm bells.
That’s when things can go wrong.
These scam emails are designed to make you react to something urgent.
They might refer to unexpected charges, invoices you don’t recognise, or even claim that your account has been suspended.
They then advise that you should act quickly, which usually means calling a number to “resolve” the issue.
The email is convincing and legitimately appears to come from Azure Monitor.
Which means it isn’t spoofed in the usual way.
It’s not impersonating Microsoft. It’s using Microsoft’s own system to send the message, which is why many email security tools allow it through.
Azure Monitor can be customised to send alerts based on certain triggers. Like a new invoice or activity on an account.
The person creating the alert can also customise the message that gets sent.
That’s what attackers are exploiting.
Using basic alert triggers, they generate convincing warnings (like billing issues) and blast them to mailing lists they control.
It’s simple and it works, because it looks like a legitimate email.
It’s a similar tactic that’s been used on other trusted platforms, like PayPal and Google tools.
It’s a familiar pattern. Use a service that people trust as the delivery method for a scam.
If you receive on of these alerts. Take a moment and pause.
That’s often the most important step.
If an email is pressuring you to act quickly, especially if it asks you to call someone or share information, stop and double-check that it's legitimate.
Go directly to your Azure account through your browser (not via any links in the email) and check for alerts there.
If the warning is real, it will show up inside your account.
And if you’re not sure, ask your IT support provider to check before you do anything.
It's a good reminder that phishing attacks have evolved. They're no longer just poorly written emails with obvious spelling mistakes. Many are well-crafted, well-timed, and delivered through systems people already trust.
That's why awareness matters more than ever. A moment of caution can make all the difference.
If you’re not completely confident your team would spot something like this, we can help. Get in touch.
Leave a comment!