Microsoft Warns Misconfigured Email Routing Can Enable Internal Domain Phishing

According to the Microsoft Threat Intelligence team, threat actors in phishing campaigns are abusing misconfigured routing and spoof protections to impersonate organisations’ domains and send emails that appear to originate internally. They have leveraged this vector to deliver a range of phishing messages, including those tied to phishing‑as‑a‑service platforms such as Tycoon 2FA, with lures from voicemails and HR notices to password resets.

The firm notes a surge in use of this tactic since May 2025 across many sectors, including campaigns that aim to siphon credentials for follow‑on fraud such as business email compromise. A typical attack exploits complex routing where the MX record points to an on‑premises Exchange environment or a third‑party service before reaching Microsoft 365, creating a spoofing gap. Microsoft said it blocked more than 13 million malicious emails linked to the Tycoon 2FA kit in October 2025.

To counter this risk, organisations are urged to enforce strict DMARC and SPF hard fail policies and to correctly configure third‑party connectors, while noting that tenants whose MX records point directly to Office 365 are not vulnerable and that Direct Send should be turned off if not required.