Cybersecurity firm Varonis has warned of an ongoing and widespread phishing campaign that exploits a seemingly benign Microsoft 365 feature to send highly convincing, spoofed emails from within a company’s own domain. This campaign, which Varonis Threat Labs has tracked across more than 70 organisations, leverages the “Direct Send” feature, designed for multifunction devices, to bypass traditional email security measures and deliver phishing emails that appear to be from legitimate internal sources.
How Does the Attack Work?
Microsoft 365’s “Direct Send” (also known as smtp-client submission or option 1) is typically used by devices like printers and scanners to send email to recipients within the same organisation. The key to its function is that it doesn’t require authentication; the email is simply relayed through Microsoft’s smart host, tenantname.mail.protection.outlook.com.
Attackers have discovered a way to abuse this process. They craft emails with spoofed headers that make it look as though the message originated from a legitimate internal user, for example, CFO@yourcompany.com. They then send these emails directly to a user’s mailbox within the targeted organisation. Because the messages are being routed through Microsoft’s own trusted infrastructure, they are not subject to the same strict security checks as typical external emails. This allows the attackers to:
- Bypass DMARC: Since the emails are not sent from the attacker’s server to an external recipient, they don’t fail the DMARC check at the recipient’s end. The message is already “inside” the network, so to speak.
- Avoid External Indicators: The email will not be flagged with a banner saying “this email is from an external sender,” as it appears to come from a trusted internal source.
This makes the spoofed emails incredibly difficult for a user to distinguish from a real internal message, significantly increasing the likelihood of a successful phishing or credential theft attempt. The attackers’ methods often involve sending fake password reset links or requests for information, leading to the compromise of user accounts and sensitive data.
What Can Organisations Do to Protect Themselves?
Varonis and other security experts recommend several actions to mitigate this threat.
1. Disable Direct Send Unless Strictly Necessary: The most effective way to prevent this exploit is to disable the Direct Send feature if your organisation doesn’t need it. Most companies can use either SMTP relay or SMTP client submission with authentication, which are more secure. Disabling it outright removes the attack vector completely.
2. Enforce Connector Rules Requiring Authentication: If you must use Direct Send, you can configure connector rules within your Microsoft 365 environment that only allow email from specific, trusted IP addresses. This prevents attackers from outside the network from using the Direct Send functionality to inject malicious emails.
3. Train Employees to Scrutinise Internal-Looking Emails: Even with technical controls in place, user awareness remains a critical line of defence. Employees should be trained to look for unusual headers or behaviour in emails, even those that appear to be from a trusted colleague. They should be encouraged to verify any requests for sensitive information or password changes through an alternative channel, such as a phone call or instant message, before clicking any links.
This ongoing campaign highlights the need for organisations to review their email configurations and not to assume that internal email is inherently secure. By taking a proactive approach to security and user education, you can significantly reduce your vulnerability to this sophisticated new form of phishing.
