Loading story…
Attackers are abusing Microsoft 365 Direct Send by submitting phishing emails with an empty SMTP envelope sender (MAIL FROM:<>) while placing a spoofed internal address in the visible From field. This bypasses the domain-comparison condition used by Exchange Online's RejectDirectSend control, enabling convincing internal-impersonation messages without a compromised Microsoft 365 account or a software vulnerability. ReliaQuest observed the technique across unrelated organizations and reproduced it in a controlled tenant.
Microsoft 365 authentication and filtering controls can still classify the messages as anonymous, high-confidence spam, or phishing because SPF, DKIM, and DMARC checks fail. However, permissive allowed-sender lists and other mail-filtering exceptions can cause delivery to user inboxes. Organizations should limit Direct Send through IP-restricted inbound connectors, remove unnecessary filtering overrides, and monitor for empty envelope senders combined with internal-looking From addresses, authentication failures, and override-assisted delivery.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Between September 2025 and August 2026, ReliaQuest examined phishing activity targeting personnel including executives, finance staff, procurement teams, and customer-facing employees. Attackers used `MAIL FROM:<>` with spoofed internal visible From addresses to evade Exchange Online RejectDirectSend's envelope-domain comparison; file-sharing notices were the most common lure.
ReliaQuest reproduced the technique in a controlled Microsoft 365 tenant: a message using the tenant domain in its envelope sender was rejected, while one using `MAIL FROM:<>` was accepted and queued with the same spoofed internal IT-support visible From address. Microsoft 365 marked the accepted test message anonymous with an SCL of 9 and routed it to Junk Email; an IP-restricted inbound connector blocked Direct Send attempts including empty-envelope messages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcereliaquest.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers abused permissive Microsoft 365 Exchange Online **Direct Send** configurations to submit spoofed phishing emails directly to organizations’ MX endpoints, impersonating trusted internal senders without compromising employee credentials. KnowBe4 Threat Labs identified 29,785 confirmed messages during July and August 2026, using document, voicemail, invoice/payment, and fake file-sharing lures to steal credentials or enable business email compromise; altered Reply-To fields redirected victims to attacker-controlled domains. The activity aligned with US Eastern business hours and peaked around 2 p.m. EST. The technique bypasses conventional email-security gateways when organizations permit Direct Send and use non-enforcing DMARC policies such as `p=none`, allowing unauthenticated mail claiming to originate from the recipient’s own domain to reach users. Organizations should disable Direct Send where it is not required, restrict Exchange Online connectors and mail-flow rules to approved IP addresses, enable DKIM, enforce DMARC rejection or quarantine policies, and hunt for purportedly internal messages bearing `X-MS-Exchange-Organization-AuthAs: Anonymous`.
Sep 11, 2026
Attackers are abusing Microsoft Exchange Online's **Direct Send** feature to deliver phishing emails that appear to come from trusted internal users, without needing authentication. The campaign has targeted more than 70 organizations, primarily in the United States, since May 2025. By using an organization's predictable smart host address and a recipient address, attackers can send messages through Microsoft's infrastructure with tools such as PowerShell, causing spoofed emails to look like legitimate internal mail and helping them evade many sender-authenticity checks, including **SPF** and **DMARC**. The activity affects Microsoft 365 recipients and can also mislead third-party security products into treating forged messages as trusted internal traffic. Defenders are being urged to enable **Reject Direct Send** in Exchange Online, enforce stricter DMARC and SPF policies, deploy anti-spoofing rules, quarantine unauthenticated messages that appear internal, and monitor Direct Send traffic for suspicious headers, routing patterns, and behavioral anomalies. Organizations are also advised to enable **MFA** to reduce the impact of successful phishing attempts.
Jun 29, 2026
Researchers at InfoGuard disclosed **Ghost-Sender**, an email spoofing weakness affecting Microsoft Exchange Online and hybrid Exchange deployments that use a third-party mail server, secure email gateway, or spam filter as the public MX record. In vulnerable setups, attackers can send messages directly to the tenant’s Exchange Online Protection endpoint and make them appear to come from **any internal or external sender**, while bypassing **SPF**, **DKIM**, and **DMARC** checks and often landing in users’ inboxes without meaningful warning. InfoGuard said the issue is simple to exploit, observed that more than 20% of scanned bug bounty domains using Exchange Online appeared vulnerable, and noted that spoofed internal messages can even display Outlook profile photos, increasing their credibility. The researchers said Microsoft’s standard protection settings, dashboards, and configuration analyzers do not clearly identify or prevent the exposure, and described a disputed disclosure process in which MSRC reportedly treated the issue as an architectural limitation rather than a security vulnerability. InfoGuard cited Microsoft support communications indicating active and widespread abuse beginning in April, and published mitigations for affected organizations: configure a wildcard **Partner Organization** connector restricted by approved IP addresses or certificates, add a priority-0 mail flow rule to quarantine messages that do not originate from trusted infrastructure or lack the expected internal authentication header, and disable **Direct Send** to reduce internal spoofing risk, though that step does not stop spoofing of arbitrary external senders.
Jun 29, 2026