Loading story…
Attackers abused permissive Microsoft 365 Exchange Online Direct Send configurations to submit spoofed phishing emails directly to organizations’ MX endpoints, impersonating trusted internal senders without compromising employee credentials. KnowBe4 Threat Labs identified 29,785 confirmed messages during July and August 2026, using document, voicemail, invoice/payment, and fake file-sharing lures to steal credentials or enable business email compromise; altered Reply-To fields redirected victims to attacker-controlled domains. The activity aligned with US Eastern business hours and peaked around 2 p.m. EST.
The technique bypasses conventional email-security gateways when organizations permit Direct Send and use non-enforcing DMARC policies such as p=none, allowing unauthenticated mail claiming to originate from the recipient’s own domain to reach users. Organizations should disable Direct Send where it is not required, restrict Exchange Online connectors and mail-flow rules to approved IP addresses, enable DKIM, enforce DMARC rejection or quarantine policies, and hunt for purportedly internal messages bearing X-MS-Exchange-Organization-AuthAs: Anonymous.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Observed Direct Send spoofed-email volume exceeded 20,000 messages on each of August 3 and August 4. The campaign included altered Reply-To domains, malicious attachments, and sends reaching as many as 900 recipients.
Attackers abused Exchange Online Direct Send to submit emails through organizations' MX endpoints while impersonating internal senders, bypassing normal email-security gateways. KnowBe4 observed 29,785 confirmed spoofed/phishing emails during the campaign, using credential-harvesting and BEC-oriented lures including document requests, voicemail alerts, invoices, payment approvals, and fake file shares.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are abusing Microsoft Exchange Online's **Direct Send** feature to deliver phishing emails that appear to come from trusted internal users, without needing authentication. The campaign has targeted more than 70 organizations, primarily in the United States, since May 2025. By using an organization's predictable smart host address and a recipient address, attackers can send messages through Microsoft's infrastructure with tools such as PowerShell, causing spoofed emails to look like legitimate internal mail and helping them evade many sender-authenticity checks, including **SPF** and **DMARC**. The activity affects Microsoft 365 recipients and can also mislead third-party security products into treating forged messages as trusted internal traffic. Defenders are being urged to enable **Reject Direct Send** in Exchange Online, enforce stricter DMARC and SPF policies, deploy anti-spoofing rules, quarantine unauthenticated messages that appear internal, and monitor Direct Send traffic for suspicious headers, routing patterns, and behavioral anomalies. Organizations are also advised to enable **MFA** to reduce the impact of successful phishing attempts.
Jun 29, 2026
Attackers are abusing Microsoft 365 Direct Send by submitting phishing emails with an empty SMTP envelope sender (`MAIL FROM:<>`) while placing a spoofed internal address in the visible From field. This bypasses the domain-comparison condition used by Exchange Online's `RejectDirectSend` control, enabling convincing internal-impersonation messages without a compromised Microsoft 365 account or a software vulnerability. ReliaQuest observed the technique across unrelated organizations and reproduced it in a controlled tenant. Microsoft 365 authentication and filtering controls can still classify the messages as anonymous, high-confidence spam, or phishing because SPF, DKIM, and DMARC checks fail. However, permissive allowed-sender lists and other mail-filtering exceptions can cause delivery to user inboxes. Organizations should limit Direct Send through IP-restricted inbound connectors, remove unnecessary filtering overrides, and monitor for empty envelope senders combined with internal-looking From addresses, authentication failures, and override-assisted delivery.
Sep 4, 2026
Microsoft detailed how **Direct Send** differs from sending mail directly to an Exchange Online tenant, highlighting that Direct Send is intended for internal-only delivery and relies on a tenant's accepted domains and mail flow configuration. The guidance drew attention to how Exchange Online handles messages addressed to tenant mailboxes and the trust assumptions involved when organizations route mail from on-premises systems or devices into Microsoft 365. CERT Bulgaria later warned of the **"Ghost-Sender"** vulnerability affecting hybrid **Exchange on-premises and Exchange Online** environments, where those trust relationships can be abused to spoof email in affected configurations. The issue impacts organizations using hybrid mail setups that bridge local Exchange infrastructure with Exchange Online, raising the risk of phishing, impersonation, and fraudulent internal-looking messages unless administrators review Direct Send usage, connector settings, and hybrid mail routing controls.
Aug 10, 2026