Reducing abuse of Microsoft 365 Exchange Online’s Direct Send
Summary: Cisco Talos reports increased malicious use of Microsoft 365 Exchange Online's Direct Send, a feature that lets unauthenticated devices like printers and legacy apps send email into a tenant by bypassing standard authentication and security checks. Talos says attackers emulate device traffic to send unauthenticated messages that appear to come from internal accounts, and cites public research from Varonis, Abnormal Security, Ironscales, Proofpoint, Barracuda, Mimecast, Arctic Wolf and others agreeing that adversaries have targeted corporations this way in recent months.
Key Takeaway: Direct Send blocks the DMARC, DKIM and SPF checks that would have rejected the spoofed American Express dispute and fake ACH payment notices shown in the report, so messages presumed internal skip sender verification entirely. Microsoft has only issued a Public Preview of its RejectDirectSend control, leaving most tenants to find and sequence their own exposure while invoice processing, document distribution and facilities notifications still depend on the feature.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026