There’s a rash of scam spam coming from a real Microsoft address

Recent reports indicate that a legitimate Microsoft email address, which the company recommends customers add to their allow list, is being exploited to send scam emails. The emails originate from no-reply-powerbi@microsoft.com, a valid address associated with Microsoft's Power BI platform, known for providing analytics and business intelligence integrated into a unified dashboard. According to Microsoft's documentation, this email address is intended for sending subscription notifications to mail-enabled security groups to avoid being blocked by spam filters. However, users are now receiving fraudulent messages claiming that unauthorized charges have been made. One Ars Technica reader reported receiving an email that falsely stated a $399 transaction had occurred, accompanied by a phone number for disputing the charge. Upon calling the number to cancel the alleged sale, the recipient was instructed to download and install a remote access application, raising concerns that scammers aimed to gain control of their computer. The email in question, which has been documented in screenshots, has been reported by multiple others online, with some instances appearing even on Microsoft's own support forums. Sarah Sabotka, a threat researcher at Proofpoint, noted that the scammers are taking advantage of a Power BI feature that permits external email addresses to subscribe to reports. Unfortunately, the mention of the subscription is discreetly placed at the bottom of the email, making it easy for recipients to overlook. This misuse of a trusted source underscores the ongoing issue of phishing and email scams targeting unsuspecting users.