Malicious Activity on Account

Take these actions immediately:

1. Change credentials for privileged access Immediately change credentials for tenant admins and anyone with RBAC access on the Azure subscription. Ensure MFA is registered and enforced for tenant admins and RBAC owners.
2. Review for suspicious sign-ins and risky identities
   • Review the Microsoft Entra sign-in logs for unusual sign-in patterns around the time the VM was created.
   • In the Azure portal, review which users, tenants, and subscriptions are at risk, and investigate Identity Protection Risk Reports if available.
   • Review admin password recovery emails and phone numbers in Microsoft Entra ID and update them if needed.
3. Check what was changed in the subscription Review the Azure Activity Log for unauthorized activity such as resource creation, configuration changes, or billing-related changes.
4. Remove the unauthorized resources Deallocate and remove any resources created by the unauthorized party, including the VM named GOD and any related disks or other resources. After the incident, also clean up storage such as unattached disks.
5. Watch for cost anomalies Review spending anomalies against the subscription budget in Azure Cost Management.
6. Contact Azure support immediately Create a billing support request to report the compromise and discuss the charges.

A working path in Azure portal is:

1. Go to Help + Support.
2. Select Create a support request.
3. In Support + Troubleshooting, enter Billing and select Billing.
4. Select the affected subscription and continue.
5. If suggested solutions appear, choose Create a support request or Return to support request to continue the case creation flow.
6. Complete the case details and submit it.

Billing and subscription support is described as free in the cited Q&A guidance.

• Detect and respond to security alerts
• Azure Account Compromised - Microsoft Q&A
• Who can I speak with about a hacked Azure account that has sudden enormous costs? - Microsoft Q&A