Hackers Exploiting .onmicrosoft.com Domains to Launch TOAD Scam Attack

Attackers are registering Azure tenants that use the default *.onmicrosoft.com domain to send Microsoft invitation emails that include social-engineered messages urging recipients to call fraudulent support numbers (Telephone-Oriented Attack Delivery). Because the invites originate from Microsoft infrastructure they often bypass email gateways; the report advises deploying an Exchange Transport Rule with a regex to detect the onmicrosoft.com pattern, auditing partners that legitimately use the default domain, and whitelisting or requesting custom domains to prevent business disruption.