Hackers Exploit Microsoft 365 Direct Send to Evade Filters and Steal Data

Cybercriminals are abusing a legitimate Microsoft 365 feature, Exchange Online’s Direct Send, to bypass authentication checks and deliver internal-looking messages for phishing campaigns and business email compromise. According to Cisco Talos, increased malicious activity is leveraging Direct Send for these campaigns, with findings echoed by vendors such as Varonis, Abnormal Security, Ironscales, Proofpoint, Barracuda, Mimecast, and Arctic Wolf.

The feature was designed to allow devices and legacy applications—such as multifunction printers, scanners, building automation systems, and older line-of-business software—to send email within corporate tenants without modern authentication. Microsoft has acknowledged the security implications and introduced a Public Preview of the RejectDirectSend control, signalling improvements like Direct Send-specific usage reports and a future default-off posture for new tenants.

Defence guidance includes disabling or restricting Direct Send where feasible, auditing device inventories and connector configurations, enabling Set-OrganizationConfig -RejectDirectSend $true, and migrating to authenticated SMTP on port 587 where possible, while maintaining layered protections such as SPF, DKIM, and DMARC alongside conditional access and egress restrictions.