Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

Exploit-DB RSS Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Threat actors are actively exploiting Microsoft 365's Direct Send feature to deliver phishing emails, bypassing perimeter security solutions by routing malicious messages through trusted infrastructure. This technique requires no credentials, only knowledge of the target domain and valid recipient addresses. The attack process involves identifying organizational domains, crafting emails impersonating internal users, and delivering them through Microsoft 365's infrastructure. Recent campaigns have successfully harvested credentials and established footholds within targeted environments. Attackers use automated tools to generate convincing business-themed lures, often utilizing PDF and DOCX attachments with QR codes or obfuscated HTML leading to phishing pages. The abuse of Direct Send represents a critical gap in email security defenses, particularly for organizations relying heavily on email communications.

The threat involves malicious actors exploiting the Microsoft 365 Direct Send feature to conduct phishing campaigns that bypass traditional perimeter email security controls. Direct Send is designed to allow organizations to send emails from internal devices or applications directly through Microsoft 365 infrastructure without requiring SMTP authentication credentials. Attackers leverage this by identifying target organizational domains and valid recipient email addresses, enabling them to craft emails that appear to originate from internal users or trusted sources within the organization. This technique does not require stolen credentials, only knowledge of the target domain and recipient addresses, making it accessible to a wide range of threat actors.

The attack process typically involves reconnaissance to identify organizational domains and valid email addresses, followed by the creation of convincing phishing emails that often include business-themed lures. These emails frequently contain PDF or DOCX attachments embedded with QR codes or obfuscated HTML that redirect victims to phishing websites designed to harvest credentials or deliver malware. Because the emails are routed through Microsoft 365's trusted infrastructure, they can evade many traditional email security solutions that rely on external reputation or sender verification checks.

Recent campaigns exploiting this technique have successfully harvested credentials and established footholds within targeted environments, facilitating further compromise such as business email compromise (BEC) and lateral movement. The abuse of Direct Send represents a critical gap in email security defenses, especially for organizations heavily reliant on Microsoft 365 for email communications. The threat is compounded by the use of automated tools to generate highly convincing phishing content, increasing the likelihood of victim interaction and successful exploitation.

Detailed information about Microsoft 365 Direct Send Abuse: Phishing Risks & Security Recommendations. Get real-time updates, technical details, and mitigation 

Title	Severity	Type	Source	Date

Threats Tagged 'direct send'

Filter Threats

Threats Tagged 'direct send'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility