{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Daily Security Review","title":"Microsoft 365 Direct Send Exploited: How Phishing Emails Masquerade as Internal Messages","html":"","width":"100%","height":180,"duration":2504,"description":"Phishing has long been a favored weapon of cybercriminals, but a recent revelation about Microsoft 365’s Direct Send feature has elevated the threat to a new level—from inside the firewall. Designed for internal systems to send notifications without authentication, Direct Send can be abused by malicious actors to spoof emails that appear to originate from trusted internal sources. Without compromising a single user account, attackers can craft phishing messages that bypass standard defenses like DMARC and SPF, exploiting an organization’s own email infrastructure against it.\nIn this episode, we dive deep into how this vulnerability is being exploited, why it remains a blind spot in many organizations’ security architectures, and how to effectively defend against it. Drawing on insights from security researchers and real-world abuse cases, we explore the technical mechanics and organizational gaps that make this attack vector so potent.\nWhat you’ll learn:\nHow Microsoft 365’s Direct Send works—and why it lacks proper authentication controls\nThe mechanics of the exploit: Using PowerShell and smart host predictability to impersonate internal users\nWhy SPF, DKIM, and DMARC checks fail to stop these spoofed internal emails\nHeader and behavioral indicators that reveal Direct Send abuse in action\nThe critical role of DMARC policy enforcement (moving from monitoring to reject mode)\nBest practices to disable or restrict Direct Send usage without disrupting hybrid Exchange environments\nHow attackers leverage trusted internal appearances to gain user trust and credentials\nBroader email security protocols—SPF, DKIM, and DMARC—and how they function together\nThe importance of phishing-resistant MFA, continuous user training, and strong password policies\nHow small and medium businesses can close these gaps even without large cybersecurity teams\nThis case serves as a stark reminder: cybercriminals are constantly looking for ways to subvert legitimate features in everyday...","thumbnail_url":"https://img.transistorcdn.com/pL79_MJFeJHamQ_ztImsGmDSMdl27VMk_30TAkieujE/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8yNzg5/ZjlhNzM5Y2M4Njli/NjkxNzgyODA2Nzhi/MDI2ZC5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}