Azure Security Breach

Scott Morask 0

I've received this email and don't know if it's valid. I called the number but didn't even get a dial tone. Complete silence on phone. No idea who Azure is or how I can get rid of.

Thank you in advance

Microsoft accountMicrosoft accountSecurity Breach AlertWe trust this message reaches you in good health. We wish to inform you that we've identified recent login activity originating from Austria on your account. As a precautionary measure to safeguard your personal information, we have temporarily placed a hold on your account.**This action was prompted by a transaction of $619.00 associated with your Azure subscription. Please be assured that we have taken immediate measures to enhance the security of your account.**Please contact us at +1(800) 611-7870 as soon as you read this email.

Givary-MSFT 33,161 Reputation points Microsoft Employee

2024-07-24T06:21:56.4766667+00:00

@Scott Morask Thank you for reaching out to us, could you help us with the screenshot of the alert which you received on your email (make sure hide all the PII details like subscription/personal details) while posting over here.

Make sure this is not a phishing email, refer to this - https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44

Let me know if you have any questions, feel free to post back.
Tung Mai 0 Reputation points

2024-07-24T12:27:18.0066667+00:00

I received a similar email. I am also wondering if the email is legit. I have no idea what Microsoft Azure membership is. I CC’d and pasted the email below with my personal info marked off.

============================= =====

Μicroѕоft Team

Update your Security Info

We're concerned that someone is using your account associated with the email address xxxx@xxxx.xxx. without your knowledge. Recent activity on your account has seemed to be occurred either from a suspicious location or under circumstances that may be different than usual.

Furthermore, a $746.00 transaction from Cape Verde has been recorded for your Μicroѕоft Azure membership. In order to safeguard your account, as a result we have suspended all activities until we have an opportunity to verify these actions.

If you did not authorize this transaction, please contact (800) 611-7870 to speak with an Account Security Analyst who can help you get back into your account. We'll help you avoid any potential fraudulent charges, update your security settings, and verify your identity.

Sincerely,

(Name of the Account Analyst) Account Analyst Μicroѕоft (800) 611-7870

=======================

please let me know if I should ignore this email. Thank You,
Scott Weaver 0 Reputation points

2024-07-26T18:19:42.8466667+00:00

Same email here. The odd thing is that the email sender is: "Microsoft Team" purchasing@engage.microsoft.comThere are no links - Just the phone #.

==================================

From: "Microsoft Team" purchasing@engage.microsoft.com

Subject: login Noticed Number#764960559da5

Μicroѕоft Team

Update your Security Info

We're concerned that someone is using your account associated with the email address xxx@xxx.xxx without your knowledge. Recent activity on your account has seemed to be occurred either from a suspicious location or under circumstances that may be different than usual.

Furthermore, a $105.00 transaction from Christmas Island has been recorded for your Μicroѕоft Azure membership. In order to safeguard your account, as a result we have suspended all activities until we have an opportunity to verify these actions.

If you did not authorize this transaction, please contact (800) 611-7870 to speak with an Account Security Analyst who can help you get back into your account. We'll help you avoid any potential fraudulent charges, update your security settings, and verify your identity.

Sincerely,

Gibson white Account Analyst Μicroѕоft (800) 611-7870

Μicroѕоft Corporation, One Μicroѕоft Way, Redmond, WA 95082
Scott Weaver 0 Reputation points

2024-07-26T18:37:39.8666667+00:00

I tried to edit the comment above w/more info and just keep getting errors when I save -

Reverse 800 lookup via 800ForAll.com provides this info for 800-611-7870: "Bandwidth Inc. 888-969-5009"

So Gibson white is NOT a Microsoft "Account Analyst"?

How can the Sender be using a microsoft.com URL if its not legit!?...
Scott Weaver 0 Reputation points

2024-07-26T19:32:42.2566667+00:00

Unless of course this email account was hijacked!?
Tung Mai 0 Reputation points

2024-07-26T20:15:14.5+00:00

Additional Info:

When I unmasked the sender ( see email I received from my previous post) , it shows:

================================

"Microsoft Team" alerts@engage.microsoft.com

=================================

which is a different sender from Scott Weaver’s post.
Scott Weaver 0 Reputation points

2024-07-26T20:31:57.5666667+00:00

Yes, but same URL. This bugger has hijacked this Microsoft URL to set up fake email accounts. Most probably collecting phone #'s when called. Best of luck with the wave of TXT spam coming if you called them! But that's not anything unusual these days. (sigh)
Scott Weaver 0 Reputation points

2024-07-26T20:45:50.11+00:00

Try a 'Net search on "engage.microsoft.com". Definitely a phishing email. Must have spoofed the URL somehow.

Share via

Azure Security Breach

Your answer