Loading story…
Microsoft has announced the indefinite cancellation of its previously planned Mailbox External Recipient Rate Limit for Exchange Online, which would have imposed a daily cap on the number of external recipients for bulk email senders. The decision follows significant negative feedback from customers who reported that the proposed restriction would disrupt legitimate business operations, especially given the limited alternatives for bulk email sending. Microsoft emphasized its commitment to balancing security with usability and stated that it will seek smarter, more adaptive approaches to combat spam and abuse without hindering essential workflows.
While the external recipient rate limit has been scrapped, Microsoft confirmed that existing protections, such as the Recipient Rate Limit and Tenant-level External Recipient Rate Limit, remain in effect to prevent abuse. The company reiterated its intention to continue listening to customer feedback and to develop alternative security measures that do not impede business needs. In parallel, other major providers like Google are also tightening controls on bulk email to combat spam and phishing, requiring stricter authentication and compliance with new guidelines for high-volume senders.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
In early January 2026, Microsoft indefinitely canceled the planned 2,000 external-recipient daily limit for Exchange Online after significant customer feedback about operational disruption. The company said existing limits would remain in place while it pursues less disruptive, more adaptive anti-abuse measures.
Microsoft scheduled the new Exchange Online external recipient cap to begin enforcement in 2025, with new tenants affected first and existing tenants later. The rollout was meant to phase in the anti-spam control while preserving existing recipient and tenant-level limits.
In April 2024, Google introduced stricter requirements for bulk email senders to Gmail accounts, including SPF/DKIM and DMARC authentication, easier unsubscribe options, and compliance with new anti-spam rules. The changes reflected broader industry efforts to harden email ecosystems against spam and phishing.
Microsoft announced plans in April 2024 to introduce a Mailbox External Recipient Rate Limit for Exchange Online, including a 2,000 external-recipient-per-day cap for bulk senders. The measure was intended to reduce spam, abuse, and malicious email activity from compromised or misused accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft is expanding end-user reporting capabilities in **Microsoft Teams** by enabling **Defender for Office 365 Plan 1** customers to report suspicious messages directly in Teams (Roadmap ID `531760`), a capability previously limited to Plan 2. The feature is intended to strengthen collaboration-platform defenses by letting users classify messages as **Security Risk** (suspected phishing/malware/spam) or **Not a Security Risk** (false positives), providing additional signals to SOC workflows and improving detection for chat-based social engineering such as **BEC-style** lures delivered via Teams; the rollout is expected to complete by late March 2026 and requires administrative enablement. Separately, Microsoft acknowledged an **Exchange Online** service issue in which legitimate emails were incorrectly marked as phishing/spam and quarantined, disrupting some users’ ability to send/receive email. Microsoft attributed the false positives to a **new URL rule** that misclassified certain legitimate URLs/domains as malicious due to evolving detection criteria; some previously quarantined messages may begin reappearing as mitigations roll out, but other emails may remain quarantined until the fix is fully deployed, and affected organizations are advised to review quarantine for missing legitimate mail.
Jun 29, 2026
Attackers abused permissive Microsoft 365 Exchange Online **Direct Send** configurations to submit spoofed phishing emails directly to organizations’ MX endpoints, impersonating trusted internal senders without compromising employee credentials. KnowBe4 Threat Labs identified 29,785 confirmed messages during July and August 2026, using document, voicemail, invoice/payment, and fake file-sharing lures to steal credentials or enable business email compromise; altered Reply-To fields redirected victims to attacker-controlled domains. The activity aligned with US Eastern business hours and peaked around 2 p.m. EST. The technique bypasses conventional email-security gateways when organizations permit Direct Send and use non-enforcing DMARC policies such as `p=none`, allowing unauthenticated mail claiming to originate from the recipient’s own domain to reach users. Organizations should disable Direct Send where it is not required, restrict Exchange Online connectors and mail-flow rules to approved IP addresses, enable DKIM, enforce DMARC rejection or quarantine policies, and hunt for purportedly internal messages bearing `X-MS-Exchange-Organization-AuthAs: Anonymous`.
Sep 11, 2026
Researchers at InfoGuard disclosed **Ghost-Sender**, an email spoofing weakness affecting Microsoft Exchange Online and hybrid Exchange deployments that use a third-party mail server, secure email gateway, or spam filter as the public MX record. In vulnerable setups, attackers can send messages directly to the tenant’s Exchange Online Protection endpoint and make them appear to come from **any internal or external sender**, while bypassing **SPF**, **DKIM**, and **DMARC** checks and often landing in users’ inboxes without meaningful warning. InfoGuard said the issue is simple to exploit, observed that more than 20% of scanned bug bounty domains using Exchange Online appeared vulnerable, and noted that spoofed internal messages can even display Outlook profile photos, increasing their credibility. The researchers said Microsoft’s standard protection settings, dashboards, and configuration analyzers do not clearly identify or prevent the exposure, and described a disputed disclosure process in which MSRC reportedly treated the issue as an architectural limitation rather than a security vulnerability. InfoGuard cited Microsoft support communications indicating active and widespread abuse beginning in April, and published mitigations for affected organizations: configure a wildcard **Partner Organization** connector restricted by approved IP addresses or certificates, add a priority-0 mail flow rule to quarantine messages that do not originate from trusted infrastructure or lack the expected internal authentication header, and disable **Direct Send** to reduce internal spoofing risk, though that step does not stop spoofing of arbitrary external senders.
Jun 29, 2026