Microsoft 365 Direct Send Abuse Fuels Nearly 30,000 Phishing Emails

A KnowBe4 Threat Lab study tracked a phishing campaign abusing Microsoft 365’s Direct Send feature, with 29,785 confirmed phishing emails observed across July and August 2026. The attackers exploited Direct Send—intended for devices like printers and scanners and for legacy apps—to deliver messages that appear to originate from trusted internal addresses (e.g., HR, accounting, admin).

The activity displayed a distinctly human pattern, largely confined to US Eastern business hours and peaking just before noon, then rising again around 2pm EST on weekdays.

The researchers noted that about 35% of the phishing emails carried attachments, including fake document requests, invoices, payment approvals and fake OneDrive shares, and that 4,023 messages used a reply-to address in a different domain, directing responses to the attacker. In at least one case, a single campaign email reached 900 recipients.

Mitigations highlighted include monitoring for the Exchange header X-MS-Exchange-Organization-AuthAs: Anonymous, enforcing DMARC policies (preferably p=reject), restricting legitimate senders via Exchange Online connectors to approved IPs, and disabling the Direct Send pathway if unused. Enabling DKIM signing further assists DMARC in rejecting unauthenticated messages. These steps aim to curb unauthenticated delivery paths and reduce the risk of spoofed internal-origin emails slipping past security controls.