Attackers made Microsoft's own Azure Monitor send a fake $459.90 Windows Defender bill that passed SPF, DKIM and DMARC. A reviewer cleared it. How it worked.
Social Engineering Examples·4 sources
This callback phishing email really did come from Microsoft. Attackers opened a real Azure subscription and set up an Azure Monitor alert rule, then stuffed a fake "Windows Defender" bill for $459.90 into the alert text, with two phone numbers "to dispute" the charge. When the alert fired, Microsoft's own servers sent it from azure-noreply@microsoft.com. It passed SPF, DKIM and DMARC, and every link went to portal.azure.com. At one company, a security reviewer looked at it and marked it a false positive. Email security firm IRONSCALES published the case on 21 March 2026. Status: Vendor report; victims not named.
| Step | What the attacker did, per IRONSCALES |
|---|---|
| Set up | Opened a real Azure subscription and made a resource group called "pay-cbb33c4ab1" |
| Rig the alert | Created a metric alert rule called "Payment Completion Notice-cbb33c4ab1", severity 2 |
| Write the bait | Used the alert's free-text fields for a fake "MICROSOFT CORPORATION BILLING AND ACCOUNT SECURITY NOTICE" with reference MS-FRA-6673829-KP, a $459.90 Windows Defender charge and two callback numbers that appear on no Microsoft support page |
| Let Microsoft send it | The alert fired and Azure Monitor emailed it through Microsoft's real outbound servers |
| Wait for the call | Anyone who rang to dispute the charge would reach the attackers |
The subject line looked exactly like a normal alert: "Azure: Activated Severity: 2 Payment Completion Notice-cbb33c4ab1". For most staff, that's routine cloud noise.
Tip: never call a number printed in an unexpected bill, even from a sender you trust. Look up the company's support number yourself.
Coverage often blurs these together. They're separate.
| Sample | Target | Charge | What happened |
|---|---|---|---|
| IRONSCALES main case | A global IoT technology company (unnamed) | $459.90 | A human reviewer cleared it as a false positive |
| IRONSCALES companion case | A mid-size US professional services firm (unnamed), "Your Payment Has Been Received", transaction ID PP456-887A-22B | $459.90 | Quarantined in 4 mailboxes before anyone engaged |
| BleepingComputer's find | Not stated. Dated 5 March 2026, mixing the main case's reference with the companion's transaction ID and different phone numbers | $389.90 | Reported in the wild |
The two IRONSCALES write-ups also list different sender IPs and link domains. Don't merge their indicators.
Think about what a security analyst checks first. Sender domain? Microsoft. Authentication? Pass on all three. Links? Microsoft's portal. Attachments? None. Every box says safe.
IRONSCALES argues that was the point. If the reviewer clears it, the last chance to catch it is gone. If someone calls the number, the attacker gets a live victim on the phone. Either way the campaign wins. No law enforcement action, loss figure or named group has been tied to any of the samples.
See also callback phishing, vishing examples and tech support scams.
Attackers set up a real Azure Monitor alert so Microsoft's own servers emailed a fake $459.90 Windows Defender bill with phone numbers to call.
It genuinely came from Microsoft's mail servers, so SPF, DKIM and DMARC all passed, and the links pointed to portal.azure.com.
Not that's been reported. IRONSCALES doesn't say whether the employee in its main case called the number.
Telephone-oriented attack delivery: an email that pushes you to call a number, so the actual fraud happens on the phone.
Social Engineering Examples. “Azure Monitor callback phishing: a real Microsoft email with a fake $459.90 bill (2026)”. Accessed 3 November 2026. https://socialengineeringexamples.com/azure-monitor-alert-toad-billing-scam-2026
Not directly documented by any source, but consistent with this attack class, the operation likely began with selecting target organizations or mailing lists (per BleepingComputer, delivery ran through a mailing list believed to be attacker-controlled) and studying the genuine formatting conventions of Azure Monitor action-group alert emails (subject-line pattern, sender address, template structure) closely enough to inject convincing fraudulent text into them.
There is little a defender can do to stop an attacker from studying publicly visible Azure Monitor alert formatting, since that structure is intentionally public and documented by Microsoft; the realistic control sits at Stage 2, where the fraudulent resource construction itself becomes detectable.
The attacker created a real Azure subscription and, within it, a resource group ("pay-cbb33c4ab1" in the primary case) and an Azure Monitor metric alert rule with a billing-themed name, then used the free-text description field that Azure Monitor exposes for alert rules to inject a fabricated "Windows Defender" billing dispute notice, complete with a fake reference number, dollar amount, and attacker-controlled callback numbers.
IPSIP's writeup recommends Azure-configuration/cloud-governance monitoring, auditing changes to Action Groups and Alert Rules for keywords like "invoice," "payment," or "billing" appearing in rules created by unrecognized principals, and enforcing MFA-gated, least-privilege access to who can create or modify alert rules and their free-text fields, whether on an organization's own tenant or as a pattern Microsoft itself could monitor for at the platform level.
The attacker triggered the alert rule so that Microsoft's own Azure Monitor notification pipeline generated and sent the email itself, from the genuine azure-noreply@microsoft.com address through Microsoft's outbound mail servers, producing a message with a fully passing SPF/DKIM/DMARC result because it truly originated on Microsoft's infrastructure.
Because the message is genuinely SPF/DKIM/DMARC-authenticated and delivered through Microsoft's real mail infrastructure, standard sender-authentication controls cannot block delivery at this stage; IRONSCALES' own reporting frames this as the central lesson, that authentication verifies who sent a message, not whether its content is safe.
Because the email carried no malicious link or attachment, only genuine Microsoft domains (portal.azure.com and related) and a fraudulent paragraph of text plus a phone number, URL-reputation scanners and attachment/sandbox detonation had nothing to flag, and sender-authentication checks affirmatively vouched for the message.
Deploy behavioral or content-anomaly detection, such as IRONSCALES' own Adaptive AI (Themis) engine, that flags the mismatch between an infrastructure-monitoring template and injected billing/payment language, first-time-sender-to-recipient anomalies, and community threat-intelligence patterns, rather than relying solely on URL- or attachment-scanning verdicts.
A security reviewer (in the primary case) or an automated behavioral system (in the companion case) evaluated the alert. In the primary case, seeing a genuine Microsoft sender with fully passing authentication and no flagged links, the human reviewer classified the message as a false positive rather than a phishing attempt.
Train SOC reviewers and end users not to auto-clear a ticket as a false positive solely because authentication headers pass; give reviewers an explicit rule that a billing dispute demand with a call-to-action phone number, embedded inside an unrelated infrastructure-monitoring alert, is itself the indicator, regardless of sender legitimacy.
The intended final step, for any recipient who called one of the attacker-controlled numbers, was a live phone conversation in which the attacker would attempt to extract payment-card details, account credentials, or induce installation of remote-access software under the pretext of "verifying" or "disputing" the fake charge; neither IRONSCALES case discloses whether a recipient actually completed this step.
Treat any callback number embedded in an unsolicited billing or security alert as an unverified indicator and look up the vendor's real support number independently rather than dialing the number in the message; this end-user step is the last available control once delivery and triage have both failed to stop the message.
Browse by what this case has in common with others in the library.
A caller posing as Standard Bank got an 18-year-old to move her R438,900 education fund to a 'safe' account in…
A small Columbus, Ohio public materials manufacturer disclosed in a February 2026 SEC 8-K that it lost $898,325 to an…
APT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
Fraudsters faked WPP CEO Mark Read on WhatsApp and staged a Teams call with a cloned executive voice. The agency…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
Air Canada admitted in a sworn Ontario Superior Court affidavit that it hired private investigators who twice took trash from…
A Lapsus$ affiliate used a contractor's stolen Uber password, likely bought on the dark web, flooded them with MFA push…
A Costa Rica-based telemarketing ringleader used VOIP-spoofed Washington D.C. caller ID and fake government-official personas to convince hundreds of mostly…
A phishing attack resulted in disclosure of 2015 W-2 data for several thousand US employees, exposing SSNs and earnings to…
The EA data breach began in June 2021, when hackers used a Slack session cookie they said cost $10 to…
OpenAI says a Russian-speaking actor used throwaway ChatGPT accounts to build Windows malware, spread as a fake Crosshair-X gaming tool.…
A job candidate at Vidoc Security Lab hid behind a real-time face filter and refused to cover his face. What…
CVS pharmacies nationwide tossed pill bottles, prescriptions, and employee SSNs into unsecured public dumpsters; media exposure across a dozen-plus cities…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
In 2022, 0ktapus texted staff fake IT alerts linking to Okta lookalikes, stealing 9,931 logins and MFA codes. Twilio was…
Orlando police pulled about 200 fake QR stickers off downtown parking meters in June 2025. How to spot them: white…
Fraudsters impersonating an Ascend Laboratories executive convinced Alkem Laboratories to wire USD 6,161,336 (about Rs 51.30 crore) to a fraudulent…
Google found PROMPTFLUX, a dropper that asks Gemini for antivirus-evasion code mid-run. Its self-rewrite feature was switched off and it…
A Mattel finance executive wired $3M to China on a forged email from her brand-new CEO, and the company clawed…
Scammers impersonating a school construction contractor submitted a bank-account-change request with seemingly valid documentation, and Cabarrus County, NC wired $2.5M…
A compromised email sent a Wheeling, WV nonprofit a fake solar panel invoice. It paid $30,750 to an Oklahoma man's…
A scammer spoofed a New Zealand bank's number and obtained authentication codes by claiming they would suspend banking and cancel…
Social Engineering Examples