Security Advisory: Attackers Are Exploiting M365 Direct Send to Spoof Internal Emails

Attackers are actively exploiting a legitimate Microsoft 365 feature called Direct Send to deliver spoofed emails that appear to come from within your organization. These emails bypass SPF, DKIM, and DMARC checks, making them difficult to detect with traditional email security tools. This article explains the threat, how it works, and what you can do to protect your environment.

What Is Direct Send?

Direct Send is a Microsoft 365 mail flow method that allows on-premises devices (printers, scanners, and line-of-business applications) to send emails directly to mailboxes within your tenant. It works by sending to your MX endpoint using your own domain as the sender address, without requiring any authentication.

This is by design. Microsoft intended Direct Send for trusted internal devices that need to email users within the organization (e.g., a scanner sending a PDF to an employee). However, because it requires no authentication and no credentials, anyone who knows your domain and MX record can send emails that appear to originate from inside your organization.

Why Attackers Are Targeting Direct Send

Since May 2025, security researchers have observed a significant increase in attacks abusing Direct Send, compromising over 70 organizations across the US, particularly in manufacturing, consulting, and healthcare. The technique is effective for three reasons:

• No authentication required: Direct Send emails bypass SPF, DKIM, and DMARC because the feature was designed to work without them. This means the emails often appear legitimate to both security systems and end users.
• Emails originate from Microsoft infrastructure: Because the messages route through Microsoft's own servers, many security tools treat them as trusted internal traffic by default.
• Minimal skill required: Attackers only need a domain name and a PowerShell script. Staff directories and predictable naming conventions (firstname.lastname@company.com) make it easy to spoof convincing internal senders.

What These Attacks Look Like

Researchers have identified several common patterns:

• Empty emails with malicious attachments: The email body is blank, with a PDF attachment containing a QR code or phishing link. These mimic scanner/fax notifications that employees are accustomed to receiving internally.
• Spoofed internal sender names: The "From" address matches a real employee, often targeting HR, Finance, or executive staff to initiate credential theft or business email compromise (BEC).
• AI-generated content: Some variants use AI to create convincing HR announcements, policy updates, or executive communications with polished formatting and familiar branding.

These attacks are particularly dangerous because they don't contain traditional malware or suspicious URLs. The malicious content is hidden inside attachments or behind QR codes, making them invisible to most signature-based email filters.

How to Protect Your Organization

Step 1: Disable or Restrict Direct Send

Microsoft released a new setting in April 2025 that allows administrators to reject all unauthenticated Direct Send traffic. If your organization does not use Direct Send (most don't), enabling this setting is the single most effective step you can take.

Connect to Exchange Online via PowerShell and run:

Set-OrganizationConfig -RejectDirectSend $true

The change propagates across the service within 30 minutes. Any Direct Send message received after that will be rejected with error code 550 5.7.68.

Important: If your organization uses printers, scanners, or third-party services that send email via Direct Send, you will need to set up a partner inbound connector in Exchange Online to authenticate those sources before enabling this setting. Otherwise, their messages will be blocked too. If you're unsure whether anything in your environment uses Direct Send, check your domain's SPF record. Any legitimate Direct Send senders should already be listed there.

Step 2: Strengthen Your Email Authentication

Even without disabling Direct Send, tightening your existing email authentication makes it harder for spoofed messages to reach inboxes:

• DMARC: Enforce a strict policy. Set your DMARC record to p=reject or p=quarantine rather than p=none.
• SPF: Use a hard fail (-all) rather than soft fail (~all) to ensure unauthorized senders are rejected outright.
• DKIM: Ensure DKIM signing is enabled for all legitimate outbound email from your domain.

Step 3: Monitor for Suspicious Internal Emails

Keep an eye on your email headers and mail flow logs for warning signs:

• Emails that appear internal but show SPF or DKIM failures in the headers.
• Messages with unusual user-agent strings, which may indicate automated or scripted sending.
• Blank emails with PDF attachments, particularly those containing QR codes.

Further Reading

• Microsoft: Introducing More Control Over Direct Send in Exchange Online: Microsoft's official announcement of the RejectDirectSend setting, including FAQs and known issues.
• IRONSCALES: Inside Job — Attackers Are Spoofing Emails with M365's Direct Send: Detailed threat research on how attackers are exploiting Direct Send in the wild.
• Microsoft Learn: How to Set Up Direct Send: Microsoft's documentation on Direct Send configuration and alternatives.