Microsoft 365 phishing bypasses email filters

Published August 30, 2026

Attackers found a way to send fake internal-looking emails to Microsoft 365 inboxes without hacking any account. They leave one technical field blank in the email, which lets the message slip past a Microsoft 365 security check meant to block spoofed internal mail.

Report priority
Medium
Targets
Exchange Online

How it works

Exchange Online's RejectDirectSend safeguard checks the hidden technical sender address on a message, not the sender name and address the recipient actually sees, so when an attacker sends mail with that hidden address left completely blank, the check has nothing to compare and lets the message through while it still displays a trusted internal address...

What to do

Instead, ask your Microsoft 365 admin whether Direct Send is enabled for your tenant and whether RejectDirectSend is the only safeguard in place. Admins can test by sending a message with a blank envelope sender through Direct Send to see if it queues instead of being rejected.

Keep RejectDirectSend enabled but don't rely on it alone. Set up an IP-restricted inbound connector that only allows unauthenticated Direct Send mail from your organization's own approved devices and applications, since ReliaQuest found this blocked every version of the attack, including the blank-sender trick.

Technical details

Affected software: Exchange Online

An attacker connects to a company's Microsoft 365 mail system and sends a message using the Direct Send feature meant for internal apps and devices. Instead of filling in the technical sender address, they leave it blank, and instead of a stolen password they use no account at all. The employee's inbox shows the message as if it came from their own IT support team, carrying a fake document notice or payment request, even though it came from outside the company.

RejectDirectSend evaluates the SMTP envelope sender (MAIL FROM) domain against the tenant's accepted domains, not the visible From header. When an attacker issues MAIL:< (a null reverse-path, valid per SMTP spec), there is no domain to evaluate, so the rejection logic never triggers even though the mail is unauthenticated and external. Microsoft 365's anti-spam stack still scores such mail (SPF/DKIM none, DMARC fail, high Spam Confidence Level, often routed to Junk), but trusted-sender exceptions or content-based scoring can still land it in the inbox. Mitigation is an IP-restricted inbound connector scoping Direct Send to known internal senders.

References

View Original Source