Phishers Exploit Office 365 Users Who Let Their Guard Down

Phishers are exploiting Office 365 users by spoofing domains to make messages appear internal, a tactic highlighted by Microsoft Threat Intelligence on 6 January 2026. The research notes that attackers can spoof domains through complex routing and misconfigured spoof protections in Office 365 tenants, particularly where MX records and anti-spoofing safeguards are weak.

Microsoft says that tenants who lack strict spoof protections and proper DMARC and SPF policies remain vulnerable to these schemes, which often imitate services like Docusign or HR communications to drive credential theft. The article also highlights that phishing remains reliant on social engineering and a weak security posture, with 13 million malicious emails blocked in October 2025 by Microsoft Defender for Office 365 linked to Tycoon2FA, a PhaaS platform.

It emphasises that enforcing strict DMARC policies and correctly configuring third-party connectors can help prevent spoofing and phishing attacks, alongside phishing-resistant authentication methods. According to Microsoft Threat Intelligence, these findings reflect a broader trend of increasingly sophisticated phishing tools and the ongoing need for robust domain protections in enterprise email.