Threat actors are now abusing a legitimate feature of Microsoft 365 known as Direct Send phishing to deliver fraudulent emails that appear to come from internal users. This attack method bypasses traditional email defenses by exploiting a trusted mail flow configuration, making it especially dangerous in enterprise environments. In this article, we break down how this attack works, what makes it effective, and how to defend against it using Microsoft best practices and layered security controls.

Understanding Direct Send in Microsoft 365

Microsoft 365 offers three ways to send mail from devices and applications: SMTP AUTH client submission, Microsoft 365 or Office 365 SMTP relay, and Direct Send. The Direct Send method allows email to be transmitted from an application or device (like a printer, scanner, or third-party app) directly to Microsoft 365 without authentication, as long as the IP is allowed and the domain is valid. According to Microsoft, this method supports internal email routing without needing user credentials. You can read more in their official documentation here.

How Attackers Are Exploiting Direct Send

By impersonating legitimate applications and spoofing trusted IPs, attackers can send phishing emails through Direct Send that appear to come from verified internal addresses. These emails often bypass SPF, DKIM, and DMARC checks because they technically originate from within the organization’s domain and IP allowances.

This tactic gives attackers a powerful advantage: the messages don’t look suspicious to email security filters or to users. Targets are more likely to engage with a message if it appears to come from a known colleague or internal system—especially when the content mimics invoice alerts, password change requests, or file-sharing notifications.

Why This Threat Is So Effective

Unlike typical phishing campaigns that rely on misspelled sender names or domain lookalikes, Direct Send phishing creates emails that pass as entirely legitimate in both metadata and presentation. That means:

• The sender appears internal and familiar
• Email filters may not flag the message as suspicious
• End users are less likely to report the message
• Security logs may not show obvious red flags

This creates a perfect storm of risk: high trust, low detection, and quick impact.

Recommended Mitigations and Best Practices

To protect against this type of abuse, organizations should follow Microsoft’s updated guidance on Direct Send configuration, outlined in their official documentation here.

Microsoft emphasizes several key safeguards:

• Restrict the accepted IP addresses in the mail flow rule to only known and documented devices.
• Disable Direct Send unless it’s absolutely necessary for business functions.
• Use SMTP authentication with strong credentials and MFA whenever possible instead of unauthenticated Direct Send.
• Monitor email headers and audit logs for unexpected traffic from non-mailbox sources.

Additionally, your organization should conduct regular phishing simulations to educate users on identifying unusual requests—even when they appear internal.

How Cost+ Helps Secure Your Microsoft 365 Environment

At Cost+, we proactively defend Microsoft 365 environments through a combination of prevention, monitoring, and response services. Our Security+ offering includes email threat detection, 24/7 monitoring, and hardening of misconfigured or vulnerable Microsoft 365 settings. We also assist with:

• Configuring secure mail flow and anti-spoofing policies
• Disabling unused protocols and reducing attack surface
• Alerting on abnormal internal email behavior

For organizations that rely heavily on application-based email—such as CRMs, scanners, or cloud apps—we provide auditing and remediation through our Support+ team to ensure your Direct Send configuration doesn’t become an open door for attackers.

Next Steps for Security and IT Teams

If your organization uses Direct Send—or isn’t sure how it’s configured—it’s critical to perform an immediate review. Start by inventorying every device or application that’s allowed to send mail using this method. Then verify:

• Each sending IP is expected and documented
• No new mail flow rules have been added or modified unexpectedly
• End user reports of “weird” internal messages are followed up with proper investigation

You should also configure alerts for any unusual spikes in email volume from IPs tied to Direct Send or apps using SMTP relay. These patterns often precede broader phishing campaigns.

Final Thoughts

Direct Send phishing is a reminder that even legitimate tools can become threat vectors when not properly governed. Microsoft’s built-in mail delivery flexibility helps businesses function efficiently—but it also creates opportunities for abuse if not configured securely.

By following Microsoft’s published best practices and layering your security defenses, you can reduce risk while preserving business continuity. Cost+ is here to help you close these gaps before they become exploited entry points.

Get in touch with us to schedule a review of your Microsoft 365 security posture—including Direct Send risk assessments and remediation planning.

By Thomas McDonald
Vice President

Business Email Compromise (BEC) is one of the most syndicate-driven cyber threats facing organizations today—and it’s growing more sophisticated than ever. Modern business email compromise schemes often use compromised email accounts, deepfake AI tools, or domain spoofing to trick employees into approving fraudulent payments.

How BEC Has Evolved

Earlier BEC scams relied on spoofed domains or fake invoices. Today, attackers often hijack real email accounts or use AI-generated mimicry to craft convincing messages. According to the FBI, more than $26 billion has been lost to BEC scams in recent years, including incidents where large firms fell victim to fake invoice fraud.

Common Modern BEC Scenarios

• CEO or executive impersonation: Attackers send urgent payment requests appearing to come from a trusted executive.
• Account takeover: Hackers gain access to a legitimate business email account and send fraudulent requests from it.
• Vendor invoice fraud: Fake invoice emails mimic real vendors and arrive just before payment cycles to avoid scrutiny.
• AI-enhanced impersonation: Deepfake voices or synthetic emails make spoofed communication even harder to detect.

Red Flags to Watch For

• Urgent or secretive tone
• Requests outside normal payment processes
• Slightly altered domain names or unfamiliar email addresses
• Instructions to change banking information or bypass verification

How to Protect Your Business

1. Verify Via a Second Channel

Always confirm payment requests using an independent method—such as a direct phone call—not via the same email thread. This simple step can stop most fraud attempts.

2. Enable Email Authentication

Implement SPF, DKIM, and DMARC email protocols. These protect your domain from being spoofed and help email recipients trust your communications. Learn more about DMARC from CISA.gov.

3. Enforce MFA and Role-Based Access

Multi-factor authentication (MFA) prevents attackers from logging into email accounts even if they’ve obtained a password. Combine this with least-privilege access policies to limit who can approve payments.

4. Train Employees on BEC Awareness

Provide practical training on how to spot suspicious emails, spoofed domains, and signs of social engineering. Simulated attacks and phishing tests improve awareness across departments.

5. Use Dual Authorization for Payments

For larger transactions, require at least two people to approve before payment is released. This makes it harder for one compromised account to result in financial loss.

6. Deploy Threat Detection Tools

Secure email gateways and threat detection tools can catch impersonation attempts, monitor for abnormal behavior, and block messages from known malicious IPs or domains. Consider a solution that includes anomaly detection and adaptive controls.

Where Cost+ Comes In

Our Security+ service helps organizations prevent business email compromise with layered protection, DMARC enforcement, staff training, and payment workflow consulting.

Bottom Line

Today’s business email compromise threats go far beyond basic phishing. Attackers are well-organized, use advanced impersonation tactics, and exploit trust in your vendors and executives. With the right training, technology, and financial safeguards, you can reduce your exposure and avoid costly mistakes.

By Thomas McDonald
Vice President