Ongoing Campaign Abuses Microsoft 365’s Direct Send to Deliver Phishing Emails

AI-suggested

European organizations should take a multi-layered approach to mitigate this threat. First, review and restrict the use of Microsoft 365's Direct Send feature; where possible, disable it or configure mail flow rules to reject emails sent via Direct Send that do not originate from authorized devices or IP addresses. Implement and enforce strict DMARC policies with a 'reject' policy to prevent spoofed emails from being accepted. Regularly monitor email headers for anomalies such as unexpected external IP addresses or authentication failures. Enhance email filtering solutions to detect and quarantine suspicious messages that exploit this feature. Conduct targeted user awareness training focused on recognizing phishing emails that appear to come from internal sources, emphasizing verification of unexpected requests even if they seem legitimate. Additionally, implement multi-factor authentication (MFA) across all accounts to reduce the impact of credential compromise. Finally, maintain up-to-date incident response plans that include procedures for handling phishing campaigns exploiting internal email spoofing.