Protecting Microsoft 365 from Internal Phishing via Direct Send Exploits

Threat actors are increasingly exploiting Microsoft 365’s Direct Send feature to conduct highly convincing internal phishing campaigns, eroding trust within organizations and challenging the efficacy of traditional security defenses. This emergent attack vector, recently highlighted by Proofpoint and other leading research groups, demonstrates the evolving sophistication of cyber adversaries as they target cloud communications infrastructure. As Microsoft 365 cements its role as the backbone of modern enterprise collaboration, awareness and mitigation of this vulnerability are critical priorities for CISOs and IT security teams worldwide.

Understanding Direct Send in Microsoft 365​

Microsoft 365’s Direct Send feature was originally introduced to support the unauthenticated relaying of emails from on-premises devices and legacy systems—such as printers, scanners, or custom business applications—directly to corporate inboxes. This means that certain devices, without the need for standard user authentication, can transmit messages inside the organization if properly configured. Administrators have generally relied on this mechanism to facilitate business processes, particularly in environments with mixed or aging technology stacks.
However, the very nature of Direct Send—allowing unauthenticated delivery based on IP and connection trust rather than credential verification—presents a structural risk when not secured rigorously. Inadequate oversight or misconfiguration can leave a door open for malicious actors to impersonate legitimate internal users, sending spoofed messages that appear wholly credible to unsuspecting employees.

Anatomy of a Sophisticated Phishing Campaign​

Proofpoint researchers have identified a persistent campaign leveraging the Direct Send feature in conjunction with unsecured third-party email security appliances. The attackers’ delivery chain can be broken down as follows:

• Initial Access: Adversaries gain RDP access (typically on port 3389) to virtual hosts running Windows Server 2022. These servers, often observed on infrastructure leased by virtual private server (VPS) providers, are controlled by attackers and configured to initiate outbound mail sessions.
• Relay Exploitation: The attackers identify and utilize Internet-exposed, third-party SMTP relay appliances as their launching pad. These relays, frequently under-protected and sometimes operating with expired or self-signed SSL certificates, take instructions from authenticated connections or even misconfigured anonymous logins.
• Email Injection: From these relays, attackers send phishing emails using spoofed internal sender addresses. The emails traverse legitimate SMTP channels, sometimes bearing valid DigiCert SSL certificates and supporting modern encryption protocols such as STARTTLS and AUTH PLAIN LOGIN—further blending with normal business traffic.
• Delivery to Microsoft 365 Users: These messages are deposited directly into internal mailboxes. Despite authentication failures (SPF, DKIM, DMARC mismatches, or suspicious “compauth=fail” flags in email headers), many messages still bypass front-line defenses and land in user inboxes or, at best, junk folders. The apparent internal origin makes them far more believable than generic external spam.

Why These Attacks Succeed​

The critical factor underpinning success is trust: emails that look like internal notices—task assignments, wire transfer requests, urgent business reminders—routinely bypass psychological skepticism and security training. Even savvy users are more likely to trust what appears to be a message from an internal department head or payroll coordinator, especially when presented without obvious warning flags. The use of familiar topics (such as voicemail notifications or invoice approvals) and formatting further increases the likelihood of engagement and, ultimately, compromise.
Another key enabler is the abuse of legitimate cloud infrastructure. By routing messages through trusted and certified relay appliances—albeit misconfigured—attackers evade many traditional security tools that rely on blacklists, anomalous sender reputation, or known malicious IP detection. The exploitation of Direct Send thus exemplifies the broader trend of attackers co-opting cloud and SaaS features to mask malicious activity as ordinary business conduct.

Indicators of Compromise (IOCs) and Technical Details​

Organizations seeking to defend against this campaign should watch for several markers that may indicate compromise or attempted intrusion. Based on current reporting, the following attacker infrastructure and artifacts have been observed:
Relays exploited in these attacks typically expose ports such as 8008, 8010, and 8015 with expired or self-signed certificates, or weak authentication protocols. Careful monitoring for these IOCs, particularly on network boundaries and in security appliance logs, can help surface malicious activity before it results in a breach.

Defense Evasion Tactics and Detection Challenges​

Once attackers have established their SMTP pipeline via Direct Send, their ability to bypass standard anti-phishing controls is markedly improved:

• Bypassing Authentication: Although messages may fail composite authentication checks (including SPF, DKIM, and DMARC), Microsoft 365’s default behavior is to quarantine or redirect such mails to junk. However, these protections are not always airtight—especially in organizations with relaxed mail handling rules or misconfigured policies.
• Exploiting Junk Folder Trust: Even when messages arrive in the junk folder, many users still access and read them, assuming false positives are responsible for misclassification. This undermines the assumed safety of segregating suspect mails rather than blocking delivery entirely.
• Chaining Legitimate Services: The campaign leverages the increasing inter-operability of cloud services and the prevalence of trusted third-party security tools. Relays running on virtual servers, cloaked with valid SSL certificates from reputable CAs like DigiCert, are more difficult to detect than conventional spam-sending botnets.
• Fast Evasion and Infrastructure Turnover: Attackers frequently rotate IP addresses, relay appliances, and hosting providers, reducing the window of opportunity for signature-based detection or blacklisting.

All of these factors reinforce the case for a layered, defense-in-depth approach that does not overly rely on any single vector of trust.

The Scope of Impact: Why This Attack Matters​

The exploitation of Direct Send is not a fringe or theoretical risk. As Microsoft 365 adoption surges across every sector—from healthcare to financial services and higher education—the population of organizations at risk is vast. Proofpoint and other researchers stress that any institution with poorly regulated relay permissions, lax authentication policies, or legacy devices connected to mail infrastructure is a potential target.
Successful exploitation can have dire consequences:

• Credential Theft and Initial Access: Convincing phishing emails prompt users to enter credentials, enabling further lateral movement within the organization.
• Business Email Compromise (BEC): Internal-looking emails can be weaponized for wire fraud, invoice redirection, or data theft.
• Spread of Malware and Ransomware: Payloads embedded in apparently benign attachments or links are more likely to be clicked when originating from “inside” an organization.
• Erosion of Internal Trust: As these attacks undermine employee confidence in internal communications, organizations experience productivity slowdowns and increased operational friction.

Best Practices and Mitigation Strategies​

To counter this emergent threat, security leaders should implement a coordinated series of technical and procedural controls. Key recommendations include:

1. Audit and Limit Direct Send Usage​

• Conduct a full audit of Direct Send usage in Microsoft 365. Enumerate which devices or applications use it and why.
• If not operationally essential, disable Direct Send entirely using PowerShell:
  Set-OrganizationConfig -RejectDirectSend $true
• For required use cases, strictly limit originating IP addresses, enforce secure certificates, and apply granular mail flow controls.

2. Harden Authentication and Validation Rules​

• Implement strict Sender Policy Framework (SPF) policies with hard fail configurations.
• Enforce DKIM signing for all outbound messages.
• Configure DMARC policies to reject (not just quarantine) messages that fail DMARC alignment.
• Routinely review authentication failure reports and adjust policies to strike an effective balance between security and legitimate mailflow.

3. Enhance Security Beyond Native Microsoft Defenses​

• Deploy advanced email security solutions—such as Proofpoint, Mimecast, or Cisco Email Security—that augment Microsoft’s built-in controls with AI-driven anomaly detection, deep content inspection, and threat intelligence integration.
• Consider security tools that can sandbox attachments and links in real time, rather than simply filtering based on heuristics.

4. Monitor and Investigate Suspicious Relay Activity​

• Log all incoming SMTP connections and monitor for unauthorized relay activity, particularly from known attacker infrastructure or IPs unfamiliar to your environment.
• Inspect mail headers for spoofing indicators, such as anomalous “From” addresses, authentication failures, or suspicious message paths.
• Use SIEM platforms (e.g., Microsoft Sentinel, Splunk) to aggregate, correlate, and alert on suspicious inbound and relay traffic.

5. Educate Employees but Don’t Rely Solely on Training​

• While user awareness training is valuable, it must be paired with technical controls. Employees often bypass warnings out of urgency or habit, particularly when messages appear internal.
• Consider running simulated phishing campaigns that specifically mimic these emerging tactics to assess organizational readiness.

6. Keep Cloud and Hybrid Configurations Up to Date​

• Regularly patch third-party security appliances and ensure relay protocols are current, supporting the latest encryption and authentication standards.
• Validate that all externally facing relay endpoints use valid, non-expired, CA-backed SSL/TLS certificates.

7. Incident Response Preparedness​

• Update incident response playbooks to include scenarios specific to internal phishing and relay-based impersonation.
• Ensure forensic analysis tools capture header data and relay logs needed to reconstruct attack chains.

Critical Analysis: Strengths, Weaknesses, and Ongoing Risks​

The widespread use of Microsoft 365’s Direct Send capability is a testament to the platform’s flexibility and its appeal for diverse business needs. However, this case highlights a fundamental truth about cloud collaboration: features designed for convenience and backward compatibility often become security liabilities if not rigorously monitored.
Strengths of the Attack:

• Exploits organizational trust and routine workflows.
• Bypasses perimeter-focused security tools and basic email authentication.
• Utilizes known, trusted cloud service infrastructure for distribution.

Notable Weaknesses and Opportunities for Defense:

• Often still fails email authentication (SPF/DKIM/DMARC), giving admins a potential detection lever—if appropriately configured.
• Relies on unsecured or minimally protected third-party relays, which can be discovered and blocked.
• Attack infrastructure (e.g., IPs, certificates) leaves forensic breadcrumbs, allowing for retrospective investigation and future blocking.

Potential Risks and Remaining Gaps:

• Many organizations lack the time, visibility, or expertise to audit granular relay usage and authentication outcomes.
• Overly aggressive DMARC or mail flow changes can inadvertently disrupt essential business emails—making IT teams wary of implementation.
• Attackers are rapidly adapting their methods, using commodity infrastructure and new relays as old ones are reported and blocked.

Despite Microsoft’s ongoing efforts to shore up the security of the 365 ecosystem, there remains a significant burden on each tenant to tailor defenses to their threat surface. Ignoring these risks could lead to costly breaches, data loss, regulatory consequences, and reputational damage.

The Path Forward: Securing the Enterprise Cloud​

As more organizations operate in hybrid and multi-cloud environments, the principle of least privilege must extend from user permissions to mail transport pathways. Features like Direct Send, while enabling business agility, cannot be left in their default state—security must catch up with adoption.
The present campaign is not an isolated incident but illustrative of a wider trend: the transformation of trusted cloud services into potent attack tools. It is incumbent upon IT leaders to stay informed about new abuse techniques, conduct continual risk assessments, and advocate for robust, layered protection frameworks that anticipate—not just react to—the shifting threat landscape.

Conclusion​

The exploitation of Microsoft 365’s Direct Send feature by determined threat actors marks a pivotal evolution in internal phishing tactics. By weaponizing legitimate features and abusing misconfigured relay infrastructure, attackers have discovered a loophole in the defenses of countless organizations. Defenders must respond with heightened vigilance, technical controls, and a strategic shift in thinking—from “good enough” email hygiene to resilient, proactive cloud security engineering. As enterprises look to balance productivity with protection, the lessons from this campaign are both clear and urgent: trust, once broken, is difficult to rebuild, and internal communication channels must be as scrupulously guarded as the network perimeter.

---

Source: gbhackers.com Hackers Exploit Microsoft 365’s Direct Send Feature for Internal Phishing Attacks