Loading story…
Attackers are abusing Microsoft Exchange Online's Direct Send feature to deliver phishing emails that appear to come from trusted internal users, without needing authentication. The campaign has targeted more than 70 organizations, primarily in the United States, since May 2025. By using an organization's predictable smart host address and a recipient address, attackers can send messages through Microsoft's infrastructure with tools such as PowerShell, causing spoofed emails to look like legitimate internal mail and helping them evade many sender-authenticity checks, including SPF and DMARC.
The activity affects Microsoft 365 recipients and can also mislead third-party security products into treating forged messages as trusted internal traffic. Defenders are being urged to enable Reject Direct Send in Exchange Online, enforce stricter DMARC and SPF policies, deploy anti-spoofing rules, quarantine unauthenticated messages that appear internal, and monitor Direct Send traffic for suspicious headers, routing patterns, and behavioral anomalies. Organizations are also advised to enable MFA to reduce the impact of successful phishing attempts.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-11, Traficom reported the Direct Send phishing campaign was still ongoing and noted that the weakness could also cause third-party security tools to treat spoofed messages as trusted internal mail. The advisory reiterated mitigations such as enabling Reject Direct Send, stricter DMARC/SPF policies, quarantining unauthenticated internal-looking mail, and enabling MFA.
By July 2025, the campaign had targeted more than 70 organizations, primarily in the United States. Reports said attackers could use tools such as PowerShell to deliver the phishing emails and recommended mitigations including enabling Reject Direct Send and stricter anti-spoofing controls.
In May 2025, attackers began using Microsoft Exchange Online's Direct Send feature to send spoofed phishing emails that appeared to come from trusted internal users without authentication. The technique relied on predictable smart host addresses and allowed messages to traverse Microsoft's infrastructure, helping them evade checks such as SPF and DMARC.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
kyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers abused permissive Microsoft 365 Exchange Online **Direct Send** configurations to submit spoofed phishing emails directly to organizations’ MX endpoints, impersonating trusted internal senders without compromising employee credentials. KnowBe4 Threat Labs identified 29,785 confirmed messages during July and August 2026, using document, voicemail, invoice/payment, and fake file-sharing lures to steal credentials or enable business email compromise; altered Reply-To fields redirected victims to attacker-controlled domains. The activity aligned with US Eastern business hours and peaked around 2 p.m. EST. The technique bypasses conventional email-security gateways when organizations permit Direct Send and use non-enforcing DMARC policies such as `p=none`, allowing unauthenticated mail claiming to originate from the recipient’s own domain to reach users. Organizations should disable Direct Send where it is not required, restrict Exchange Online connectors and mail-flow rules to approved IP addresses, enable DKIM, enforce DMARC rejection or quarantine policies, and hunt for purportedly internal messages bearing `X-MS-Exchange-Organization-AuthAs: Anonymous`.
Sep 11, 2026
Attackers are abusing Microsoft 365 Direct Send by submitting phishing emails with an empty SMTP envelope sender (`MAIL FROM:<>`) while placing a spoofed internal address in the visible From field. This bypasses the domain-comparison condition used by Exchange Online's `RejectDirectSend` control, enabling convincing internal-impersonation messages without a compromised Microsoft 365 account or a software vulnerability. ReliaQuest observed the technique across unrelated organizations and reproduced it in a controlled tenant. Microsoft 365 authentication and filtering controls can still classify the messages as anonymous, high-confidence spam, or phishing because SPF, DKIM, and DMARC checks fail. However, permissive allowed-sender lists and other mail-filtering exceptions can cause delivery to user inboxes. Organizations should limit Direct Send through IP-restricted inbound connectors, remove unnecessary filtering overrides, and monitor for empty envelope senders combined with internal-looking From addresses, authentication failures, and override-assisted delivery.
Sep 4, 2026
Microsoft detailed how **Direct Send** differs from sending mail directly to an Exchange Online tenant, highlighting that Direct Send is intended for internal-only delivery and relies on a tenant's accepted domains and mail flow configuration. The guidance drew attention to how Exchange Online handles messages addressed to tenant mailboxes and the trust assumptions involved when organizations route mail from on-premises systems or devices into Microsoft 365. CERT Bulgaria later warned of the **"Ghost-Sender"** vulnerability affecting hybrid **Exchange on-premises and Exchange Online** environments, where those trust relationships can be abused to spoof email in affected configurations. The issue impacts organizations using hybrid mail setups that bridge local Exchange infrastructure with Exchange Online, raising the risk of phishing, impersonation, and fraudulent internal-looking messages unless administrators review Direct Send usage, connector settings, and hybrid mail routing controls.
Aug 10, 2026