# Azure Monitor Alert Abuse: Detecting Callback Phishing Campaigns

> Threat actors are abusing Microsoft Azure Monitor Action Groups to send legitimate-looking callback phishing emails to bypass traditional security filters.

- Published: 2026-03-21T16:10:11.000Z
- Severity: medium
- Category: Threat Intel
- Tags: Azure Monitor, Callback Phishing, Social Engineering, Azure Action Groups
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/microsoft-azure-monitor-alerts-abused-in-callback-phishing-campaigns/
- Canonical: https://runtimerebel.com/blog/azure-monitor-alert-abuse-detecting-callback-phishing-campaigns

## Key points

- Attackers use legitimate Azure infrastructure to send phishing emails that bypass email filters and deceive users into calling fraudulent support centers.
- Microsoft Azure Monitor and its Action Group notification system are the primary mechanisms leveraged to distribute these malicious notifications.
- Organizations should restrict Action Group creation permissions and train employees to verify suspicious alerts through official internal communication channels.

## Overview
Threat actors have been identified leveraging legitimate Microsoft infrastructure to conduct sophisticated [Phishing](/glossary#phishing) operations. Specifically, according to [BleepingComputer](https://www.bleepingcomputer.com/news/security/microsoft-azure-monitor-alerts-abused-in-callback-phishing-campaigns/), attackers are abusing Azure Monitor's notification system to send callback phishing emails that appear to originate from the "Microsoft Security Team." By using the actual `azure-noreply@microsoft.com` sender address, these campaigns successfully bypass many automated email security solutions that white-list official Microsoft domains.

## Technical Analysis of Action Group Abuse
Azure Monitor allows administrators to create "Action Groups," which define a collection of notification preferences (such as email, SMS, or push notifications) triggered by specific system alerts. The [TTP](/glossary#ttp) used in this campaign involves attackers gaining access to an Azure environment—often through stolen credentials or by creating a free trial account—and configuring an Action Group containing the victim's email address.

Once the Action Group is established, the attacker triggers an alert. Because Microsoft sends a legitimate notification to the user informing them they have been added to the group, the attacker can customize certain fields within the notification template to include a fraudulent message and a phone number. This method is highly effective for **preventing Azure-based social engineering attacks** from being detected by [SOC](/glossary#soc) teams, as the email's headers, DKIM signatures, and SPF records are all valid and point directly to Microsoft.

### The Callback Phishing Mechanism
Unlike traditional phishing that relies on malicious links or attachments, callback phishing (also known as "vishing" or voice phishing) directs the recipient to call a provided telephone number. The emails often claim there has been an unauthorized charge on the user's account or a change to their subscription status. When the victim calls the number, they are connected to a fraudulent support center where the attacker attempts to convince them to install remote monitoring and management (RMM) software, providing the adversary with a foothold for [Lateral Movement](/glossary#lateral-movement) or data exfiltration.

## Detecting Azure Monitor Callback Phishing
Security teams must focus on the context of the alerts rather than the reputation of the sender domain. Because the emails originate from a trusted Microsoft service, traditional [IoC](/glossary#ioc) lists for malicious domains are ineffective. Instead, **detecting Azure Monitor callback phishing** requires monitoring for unexpected Action Group creations or modifications within the Azure portal.

Administrators should check for:
- Action Groups containing external or unfamiliar email addresses.
- Alerts that use generic or alarmist language regarding billing or security that does not align with internal naming conventions.
- Inbound emails from `azure-noreply@microsoft.com` that contain phone numbers or instructions to contact "support" outside of official Microsoft support tickets.

## Mitigation and Recommendations
To protect the environment, organizations should focus on **securing Azure Action Group configurations** through strict Identity and Access Management (IAM) policies. By default, many users may have permissions to create or modify monitoring resources; these should be restricted to a limited set of administrators.

1.  **Restrict IAM Permissions**: Ensure the `Monitoring Contributor` or `Monitoring Reader` roles are only assigned to authorized personnel. Use the principle of least privilege to prevent unauthorized users from creating Action Groups.
2.  **SIEM Integration**: Configure your [SIEM](/glossary#siem) to ingest Azure Activity Logs. Create an alert for `Microsoft.Insights/actionGroups/write` operations to identify when new notification groups are created.
3.  **User Awareness**: Inform employees that legitimate Microsoft billing or security alerts will never require them to call a phone number found within the body of an automated email. All account issues should be verified via the official Microsoft 365 or Azure admin portals.
4.  **Endpoint Protection**: Since the goal of the callback is often to install RMM tools, ensure your [EDR](/glossary#edr) is configured to block or alert on the execution of common remote access tools like AnyDesk, ScreenConnect, or TeamViewer when launched from suspicious browser processes.

**Related:** [ClickFix Attack: Windows Terminal Used for Detection Evasion](/blog/clickfix-attack-windows-terminal-used-for-detection-evasion), [SLH Recruits Women for $1,000 IT Help Desk Vishing Attacks](/blog/slh-recruits-women-for-1000-it-help-desk-vishing-attacks)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/azure-monitor-alert-abuse-detecting-callback-phishing-campaigns