Misconfigured email routing enables internal-spoofed phishing

The article discusses how attackers exploit misconfigured email routing and spoof protections to send phishing emails that appear to originate from within an organization, using phishing-as-a-service (PhaaS) platforms like Tycoon2FA. Increased phishing attacks since May 2025 have targeted various industries, leading to significant financial scams when organizations lack proper email authentication settings like DMARC and SPF policies.

Attackers often employ tactics such as crafting emails that mimic legitimate internal communication, using urgency to pressure victims, and redirecting users to fake sites. Microsoft advises organizations to enforce strict DMARC reject policies and configure third-party connectors correctly to prevent such attacks.