[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frPda-IgEG-I8nduv5nhtUCaJJS7vGp3PsXW5JJxEp3s":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"c01ccfe2-a4a9-47ca-9d35-37be7f7d193e","Scammers Use Microsoft Azure to Host Fake Windows Security Alerts Seen at 80 Organizations","scammers-use-microsoft-azure-to-host-fake-windows-security-alerts-seen-at-80-org-07b12a","Scammers are abusing Microsoft Azure to host fake Windows security alerts that pressure users into calling fraudulent support numbers. Between March and October 2026, the same fake Microsoft support kit reached users at 80 organizations. New landing pages were still appearing daily as of November 2, showing that the operation remained active. These figures describe […] The post Scammers Use Microsoft Azure to Host Fake Windows Security Alerts Seen at 80 Organizations appeared first on Cyber Security News.","Scammers are leveraging Microsoft Azure to host fake Windows security alerts, directing users to fraudulent support numbers. This operation, active between March and October 2026, exposed users at 80 organizations to scam pages. The attack starts with ads on legitimate websites leading to Azure-hosted pages that mimic system warnings, pushing users to call a toll-free number for fake support.","Scammers use Microsoft Azure to host fake Windows security alerts targeting 80 organizations.","https:\u002F\u002Fcybersecuritynews.com\u002Fscammers-use-microsoft-azure\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FScammers-Use-Microsoft-Azure-to-Host-Fake-Windows-Security-Alerts-Seen-at-80-Organizations.webp","2026-11-04T13:52:13+00:00","2026-11-04T14:00:23.063445+00:00",7,[17,20,23,25,27],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Microsoft Azure","product",{"name":24,"type":22},"Windows Firewall",{"name":26,"type":22},"Microsoft Teams",{"name":28,"type":29},"JSONP","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},[],[18,21,24],{"controls":51,"vendors":136},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"slug":82,"name":83,"problem":84,"products":85},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"slug":111,"name":112,"problem":113,"products":114},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[115,123,129],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":124,"product_name":125,"url":127,"description":128},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":111,"product_name":133,"url":134,"description":135},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":149},"azure-hosted-fake-security-alerts-target-users-across-80-organizations","Azure-Hosted Fake Security Alerts Target Users Across 80 Organizations","Scammers exploited Microsoft Azure's trusted cloud infrastructure to host convincing fake Windows security alerts, tricking users into calling fraudulent support lines. The attack succeeded primarily because end users lacked the awareness to distinguish legitimate system warnings from browser-based scam pages, and organizations failed to configure web filtering or ad-blocking controls to intercept malicious redirects. This matters because tech support scams can lead to financial loss, credential theft, and remote access compromise when victims interact with fake 'support agents.' The use of a reputable cloud platform like Azure also gave the scam pages an air of legitimacy, bypassing naive trust-based defenses.",[142,143,144,145,146,147,148],"CIS Control 14: Security Awareness and Skills Training","CIS Control 9: Email and Web Browser Protections","MITRE ATT&CK T1566: Phishing","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":150,"MITRE ATT&CK T1566: Phishing":151,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":152,"CIS Control 17: Incident Response Management":153,"CIS Control 9: Email and Web Browser Protections":154,"CIS Control 14: Security Awareness and Skills Training":155,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":156},"NIS2 mandates incident handling and awareness measures; organizations subject to this directive should have had controls and training in place to detect and respond to socially engineered scam campaigns targeting their users.","The campaign used deceptive web lures — a form of phishing — to manipulate users into calling fraudulent numbers, making phishing detection controls and user training directly applicable.","Organizations are required to ensure staff have the competence to recognize security threats; trained employees would have identified these fake alerts as social engineering rather than genuine system warnings.","With 80 organizations exposed over several months, a mature incident response capability — including a clear user-reporting channel and rapid triage process — would have shortened the campaign's operational window.","The attack chain relied on malicious ads on legitimate sites redirecting to scam pages; enterprise web filtering and browser hardening policies would have blocked or flagged those redirects before users reached the scam content.","Users at 80 organizations were deceived by fake alerts; a structured awareness program teaching employees to recognize tech support scams and browser-based social engineering would have been the primary defense.","Ensuring users understand how legitimate systems communicate security warnings (never via browser pop-ups demanding phone calls) is a governance and awareness control that would have undermined the scam's effectiveness."]