Microsoft 365 ‘Direct Send’ abused to send phishing as internal users

Source: BleepingComputer

Author: Lawrence Abrams

URL: https://www.bleepingcomputer.com/news/security/microsoft-365-direct-send-abused-to-send-phishing-as-internal-users/

ONE SENTENCE SUMMARY:

A phishing campaign exploiting Microsoft 365’s Direct Send feature bypasses security measures, targeting numerous U.S. organizations to steal credentials.

MAIN POINTS:

  1. Phishing attacks exploit Microsoft 365’s Direct Send, bypassing standard authentication and email security protocols.
  2. Direct Send enables unauthenticated email delivery via a tenant’s smart host, designed for devices like printers.
  3. Microsoft advises using Direct Send only if companies can properly manage and configure email servers.
  4. Varonis MDDR team discovered the phishing campaign targeting over 70 U.S. organizations since May 2025.
  5. Attackers primarily target financial services, manufacturing, healthcare, insurance, construction, and engineering sectors.
  6. Phishing emails impersonate voicemail or fax notifications, including PDF attachments branded with company logos.
  7. PDFs instruct victims to scan QR codes, redirecting them to fake Microsoft login pages for credential theft.
  8. Attackers utilize PowerShell scripts sent from external IP addresses to send internal-looking emails.
  9. Emails fail SPF, DKIM, DMARC checks yet pass through security as trusted internal traffic via smart host.
  10. Microsoft introduced “Reject Direct Send” setting in Exchange Admin Center to mitigate these phishing attacks.

TAKEAWAYS:

  1. Carefully evaluate if Direct Send is necessary, and if not, disable or restrict it immediately.
  2. Enable “Reject Direct Send” in Exchange Online to prevent unauthorized internal-looking emails.
  3. Implement strict DMARC policies (p=reject) to block unauthorized internal domain usage.
  4. Train employees regularly to recognize and avoid phishing attempts, especially those involving QR codes.
  5. Regularly monitor internal email traffic for signs of spoofing or abnormal behavior.