Protecting Your Organization from Microsoft 365 Direct Send Phishing Attacks

Phishing attacks continue to challenge organizations worldwide, evolving in sophistication and leveraging the very tools designed to enhance digital communication. An alarming new campaign has emerged wherein cybercriminals exploit Microsoft 365’s Direct Send feature—traditionally trusted for internal communication—to bombard enterprises with phishing emails. Security researchers warn that, since May, more than 70 organizations, spanning multiple sectors and primarily based in the United States, have already fallen victim to this innovative attack vector.

The Anatomy of Direct Send Exploitation​

At its core, Microsoft 365’s Direct Send feature allows devices and applications to send messages to recipients within a single tenant, routed through a specific smart host format like tenantname.mail.protection.outlook.com. This internal-only channel is intended for scenarios such as printers or internal applications that need basic mail capability without burdening IT teams with excessive authentication configurations.
The crux of the issue lies in Direct Send’s minimal authentication requirements. Unlike most modern email protocols, it does not demand user credentials, multifactor authentication tokens, or even formal tenant access. All an attacker needs are a lightweight set of publicly discoverable details—usually the tenant name and mail routing endpoint. As a result, Direct Send can become an inviting avenue for adversaries, especially because traditional security assumptions treat most internal-to-internal traffic as more trustworthy and less scrutinized than inbound external mail.
Recent technical analysis from the Varonis MDDR Forensics team details a stunning proof-of-concept: threat actors using PowerShell scripts to generate and transmit emails that appear impeccably legitimate, as if coming from a user or system inside the targeted organization. Because these emails are dispatched via Microsoft’s own infrastructure, they often bypass both Microsoft’s built-in security controls and additional third-party security stacks, which typically focus on securing the perimeter and external traffic.

Why This Attack Is So Effective​

There are several reasons this campaign has seen such a high rate of success:

• Bypassing Internal Controls: Most email filtering systems—including Microsoft Exchange Online Protection (EOP)—are optimized to focus on external threats. Messages sent through Direct Send look identical to routine, internally sourced emails. As a result, both Microsoft’s and most third-party filtering solutions may allow them through with little or no inspection.
• Leveraging Internal Trust: Employees are naturally less suspicious of “internal” alerts, especially those that mimic familiar templates such as company-branded voicemail notifications or system warnings. Attackers exploit this trust to insert malicious attachments or links.
• Zero Authentication Trace: Traditional indicators of compromise, such as failed logins or suspicious new access attempts, simply do not appear. Security tools that trigger on anomalous authentication or sign-in activity may not pick up on these attacks, leaving organizations blind.
• Sophistication of Spoofs: In observed cases, malicious emails are crafted to look like genuine alerts—complete with attachments, such as PDFs embedding QR codes, that redirect users to authentic-looking phishing sites. One wave of attacks involved false voicemail notifications, a tried-and-tested lure that employees are likely to open promptly.

Real-World Impact: Evidence from Recent Incidents​

The Varonis report recounts real-world post-incident investigation data, emphasizing just how subtle these attacks can be. In one case, an alert was triggered not by suspicious logins but by “abnormal behavior: Activity from stale geolocation to the organization.” A Ukrainian IP address, wholly unexpected for the tenant in question, initiated outbound emails. What was most unusual: users appeared to be emailing themselves—with PowerShell as the user agent—but no login events preceded these messages.
This particular behavioral anomaly highlights both the ingenuity of attackers and the inherent weakness of relying solely on conventional security triggers. Instead of breaking into accounts, adversaries sidestep account-based defenses and exploit trusted mail gateways, giving them access to the organization’s internal digital bloodstream.

Understanding the Attack Chain​

To fully appreciate the risks, it’s vital to unpack the anatomy of a typical campaign:

• Reconnaissance: Attackers gather information about target organizations—particularly Microsoft 365 tenant details, which can often be gleaned via straightforward means such as subdomain enumeration or through business profiles.
• Spoofed Email Dispatch: Using scripting languages like PowerShell, adversaries connect to the Direct Send smart host and broadcast emails that appear to originate from trusted users or automated systems.
• Payload or Phishing Link Delivery: These emails often carry enticing content—like a PDF claiming “You have a new voicemail,” with an embedded QR code. Scanning the code takes victims to a spoofed Microsoft 365 login page where credentials are harvested.
• Credential Harvesting and Lateral Movement: With harvested credentials, attackers can pivot, accessing further resources or launching additional, more targeted campaigns.

Critical Weaknesses Exposed​

Inadequate Authentication Controls​

The fundamental vulnerability remains Direct Send’s absence of authentication. While convenient for internal devices and applications, lack of authentication provides no barrier for attackers who manage to identify the necessary smart host endpoint. Unlike SMTP, which typically requires at least basic authentication and can be monitored for brute-force abuse, Direct Send is as simple as knowing the address.

Weak Internal Segmentation​

By relying on the premise that anything routed through internal infrastructure is presumed safe, many organizations overlook segmentation on the logical (email) and physical (network) level. This attack layer demonstrates why trusted zones need just as much oversight as external queues.

Ineffective Email Filtering and DMARC Adoption​

Despite widespread awareness of email authentication technologies—SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting & Conformance)—adoption remains spotty. Even those who deploy these tools may not enforce the strictest policies (e.g., DMARC p=reject), leaving wiggle room for spoofing. The attack also reveals weaknesses in how these standards are interpreted by email security gateways, especially for “internal” traffic.

Link and Attachment Handling​

The use of PDFs with QR codes as phishing vectors is notable. Many email security systems scan for malicious links but may miss threats in QR codes, as they are images. Scanning and sandboxing technology are evolving, but attackers continue to find ways to evade detection, leveraging human curiosity and urgency.

Guidance from Security Researchers​

In response to these revelations, security professionals, including Varonis forensics experts, have outlined critical steps organizations must consider:

• Enable “Reject Direct Send”: Microsoft has introduced a control to block unauthenticated uses of the Direct Send feature. Turn this on via the Exchange Admin Center unless it is absolutely necessary for business operations.
• Enforce Strong DMARC Policies: Set DMARC policies to p=reject to ensure spoofed emails are more likely to be flagged or rejected. This should be coupled with tight SPF configurations, ideally using “SPF hardfail” so that unauthorized senders are never trusted.
• Flag Unauthenticated Internal Emails: Configure detection rules so that any internal communication lacking proper authentication triggers an alert, is quarantined, or is subjected to enhanced scrutiny.
• Conditional Access and MFA: For cases where credentials are stolen, enforce conditional access based on trusted IP ranges, device compliance, and require multifactor authentication. This can prevent stolen credentials from being used to access critical resources.
• Limit Direct Send Usage and Monitor Smart Hosts: Use static IP addresses in SPF records and ensure all applications utilizing Direct Send are trusted, registered, and monitored. Microsoft recommends, though does not require, this additional safeguard.
• Regular User Education: Train end users to question unexpected attachments, links, and especially QR codes received in internal emails. Highlight recent attack trends as teachable moments.
• Monitor for PowerShell User Agents and Anomalous Activity: As noted in real incidents, suspicious user agents or process executions—in particular, emails sent via PowerShell—should be monitored as high-risk indicators.

Risks and Industry Implications​

The campaign’s scale—already impacting over 70 organizations, a number that may well underrepresent the true reach—highlights a systemic risk to enterprises using Microsoft 365. As nearly 90% of Fortune 500 companies and countless small to mid-sized firms rely on this platform, the attack vector is worryingly ubiquitous.

Supply Chain Exposure​

Because attackers need only one compromised or “spoofable” tenant, organizations within shared supply chains, federations, or business partnerships are all at risk. A successful campaign can create a ripple effect across interconnected organizations.

Evasion of Security Investments​

Many businesses invest heavily in advanced email security gateways, anomaly detection, and behavioral AI models. Yet these controls are frequently perimeter-focused—by design—trusting the internal traffic envelope. This campaign demonstrates a bypass that could render those investments ineffective unless organizations adapt to the new reality.

Enduring Threat: Internal Isn’t Always Trusted​

As Varonis forensics specialist Tom Barnea notes, “Direct Send is a powerful feature, but in the wrong hands, it becomes a dangerous attack vector. If you’re not actively monitoring spoofed internal emails or haven’t enabled the new protections, now is the time. Don’t assume internal means safe.” This warning underlines the evolving paradigm: internal communications can no longer be automatically trusted, no matter the vendor or platform.

Balancing Security with Operational Needs​

Disabling or severely restricting Direct Send is an obvious remedy, but not always an operationally feasible one. Many organizations have legacy workflows or devices that depend on unauthenticated internal messaging. A nuanced approach is recommended:

• Inventory and Segment: Identify all devices and applications using Direct Send, and limit access strictly to those that need it.
• Implement Least Privilege: Wherever possible, use authenticated SMTP relay or submit instead.
• Audit and Test: Regularly conduct penetration testing and red-teaming to assess whether malicious mail traffic can traverse your internal boundaries.
• Leverage Vendor Guidance: Stay up to date with advisories from Microsoft and reputable partners like Varonis. As attackers evolve tactics, so must defender playbooks.

Future Outlook: What Organizations Need to Watch​

The current spate of Microsoft 365 Direct Send abuses may prove to be a tipping point, forcing both platform vendors and security teams to reevaluate implicit trust models. Trends indicate attackers will continue seeking out weak points that blend convenience with low visibility.

• Emergence of Authentication-by-Default: There is likely to be a broader industry push for secure defaults, with features like Direct Send eventually requiring some form of device or application registration and authentication, even for internal use.
• Greater Emphasis on Intra-Organizational Threat Modeling: Security strategies must increasingly treat all mail traffic as potentially untrusted, enforcing layered controls and internal segmentation.
• Detection Over Passive Protection: While email signatures and filtering are critical, real-time monitoring for suspicious behavior—especially abuse of native scripting and automation tools like PowerShell—will become mandatory.
• User Security Hygiene Boosts: Ongoing investment in end-user education and phishing simulation remains one of the most powerful countermeasures, diluting the effectiveness of social engineering attempts embedded in sophisticated phishing campaigns.

Conclusion​

The exploitation of Microsoft 365's Direct Send feature for phishing attacks signals a significant shift in cybercriminal strategies, capitalizing on embedded trust in intra-organizational communication infrastructure. The current wave—striking over 70 organizations already—proves just how effectively attackers can weaponize convenience features against their intended victims.
The hard lesson for security professionals and IT leaders: internal is not synonymous with secure. Organizations must urgently assess their Microsoft 365 configurations, harden DMARC and SPF policies, restrict unauthenticated mail relays, and educate users about the dangers of even apparently internal communications. Comprehensive monitoring, smart policy design, and proactive posture adjustments are essential to stay ahead of both today’s—and tomorrow’s—phishing risks.
As the threat landscape continues to evolve, so too must our defenses. Those who adapt quickly will weather the storm; those who assume "internal means safe" place themselves firmly in the attackers' crosshairs.

---

Source: IT Pro Hackers are using Microsoft 365 features to bombard enterprises with phishing emails – and they’ve already hit more than 70 organizations