Loading story…
Microsoft detailed how Direct Send differs from sending mail directly to an Exchange Online tenant, highlighting that Direct Send is intended for internal-only delivery and relies on a tenant's accepted domains and mail flow configuration. The guidance drew attention to how Exchange Online handles messages addressed to tenant mailboxes and the trust assumptions involved when organizations route mail from on-premises systems or devices into Microsoft 365.
CERT Bulgaria later warned of the "Ghost-Sender" vulnerability affecting hybrid Exchange on-premises and Exchange Online environments, where those trust relationships can be abused to spoof email in affected configurations. The issue impacts organizations using hybrid mail setups that bridge local Exchange infrastructure with Exchange Online, raising the risk of phishing, impersonation, and fraudulent internal-looking messages unless administrators review Direct Send usage, connector settings, and hybrid mail routing controls.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CERT Bulgaria published a warning about the Ghost-Sender vulnerability affecting hybrid Exchange On-Premises and Exchange Online configurations. The notice identifies the issue as impacting organizations using this hybrid mail setup.
Microsoft published guidance explaining the difference between Direct Send and sending directly to an Exchange Online tenant, including how mail routing works in these configurations. This documentation is relevant to hybrid Exchange deployments affected by later Ghost-Sender reporting.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
govcert.bg
Open sourcetechcommunity.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at InfoGuard disclosed **Ghost-Sender**, an email spoofing weakness affecting Microsoft Exchange Online and hybrid Exchange deployments that use a third-party mail server, secure email gateway, or spam filter as the public MX record. In vulnerable setups, attackers can send messages directly to the tenant’s Exchange Online Protection endpoint and make them appear to come from **any internal or external sender**, while bypassing **SPF**, **DKIM**, and **DMARC** checks and often landing in users’ inboxes without meaningful warning. InfoGuard said the issue is simple to exploit, observed that more than 20% of scanned bug bounty domains using Exchange Online appeared vulnerable, and noted that spoofed internal messages can even display Outlook profile photos, increasing their credibility. The researchers said Microsoft’s standard protection settings, dashboards, and configuration analyzers do not clearly identify or prevent the exposure, and described a disputed disclosure process in which MSRC reportedly treated the issue as an architectural limitation rather than a security vulnerability. InfoGuard cited Microsoft support communications indicating active and widespread abuse beginning in April, and published mitigations for affected organizations: configure a wildcard **Partner Organization** connector restricted by approved IP addresses or certificates, add a priority-0 mail flow rule to quarantine messages that do not originate from trusted infrastructure or lack the expected internal authentication header, and disable **Direct Send** to reduce internal spoofing risk, though that step does not stop spoofing of arbitrary external senders.
Jun 29, 2026
Attackers abused permissive Microsoft 365 Exchange Online **Direct Send** configurations to submit spoofed phishing emails directly to organizations’ MX endpoints, impersonating trusted internal senders without compromising employee credentials. KnowBe4 Threat Labs identified 29,785 confirmed messages during July and August 2026, using document, voicemail, invoice/payment, and fake file-sharing lures to steal credentials or enable business email compromise; altered Reply-To fields redirected victims to attacker-controlled domains. The activity aligned with US Eastern business hours and peaked around 2 p.m. EST. The technique bypasses conventional email-security gateways when organizations permit Direct Send and use non-enforcing DMARC policies such as `p=none`, allowing unauthenticated mail claiming to originate from the recipient’s own domain to reach users. Organizations should disable Direct Send where it is not required, restrict Exchange Online connectors and mail-flow rules to approved IP addresses, enable DKIM, enforce DMARC rejection or quarantine policies, and hunt for purportedly internal messages bearing `X-MS-Exchange-Organization-AuthAs: Anonymous`.
Sep 11, 2026
Attackers are abusing Microsoft Exchange Online's **Direct Send** feature to deliver phishing emails that appear to come from trusted internal users, without needing authentication. The campaign has targeted more than 70 organizations, primarily in the United States, since May 2025. By using an organization's predictable smart host address and a recipient address, attackers can send messages through Microsoft's infrastructure with tools such as PowerShell, causing spoofed emails to look like legitimate internal mail and helping them evade many sender-authenticity checks, including **SPF** and **DMARC**. The activity affects Microsoft 365 recipients and can also mislead third-party security products into treating forged messages as trusted internal traffic. Defenders are being urged to enable **Reject Direct Send** in Exchange Online, enforce stricter DMARC and SPF policies, deploy anti-spoofing rules, quarantine unauthenticated messages that appear internal, and monitor Direct Send traffic for suspicious headers, routing patterns, and behavioral anomalies. Organizations are also advised to enable **MFA** to reduce the impact of successful phishing attempts.
Jun 29, 2026