Threat actors are abusing Microsoft Azure Monitor’s legitimate alert notification system to send phishing emails from the genuine azure-noreply@microsoft.com address, allowing messages to pass SPF, DKIM, and DMARC authentication checks. Corporate users are the primary targets; lures impersonate Microsoft billing notices citing a fabricated $389.90 Windows Defender charge and direct recipients to call attacker-controlled numbers, a technique designed to bypass email security controls that rely on authentication validation alone. If successful, follow-on objectives include credential theft, payment fraud, and remote access tool deployment, posing direct financial and operational risk to affected organizations.