Microsoft Azure threat report

Threat actors have been exploiting Microsoft Azure infrastructure to host fake Windows security alerts and phishing pages targeting users at 80 organizations since March 2026. The campaign uses programmatic advertising to distribute malicious landing pages that impersonate Microsoft security warnings and lure users into calling fraudulent support numbers. New pages were appearing daily as of November 2, 2026, and the operation remains active.

• Scammers Use Microsoft Azure to Host Fake Windows Security Alert(opens in a new tab)