Phishing actors exploit complex routing and misconfigurations to spoof domains

Phishing actors are exploiting complex routing and misconfigured spoof protections to spoof domains and send phishing emails that appear internal to organizations. Since May 2025, increased use of this attack vector has been observed, particularly with themes like voicemails and password resets, leading to credential phishing. These campaigns are opportunistic and target various industries, occasionally utilizing phishing-as-a-service platforms like Tycoon2FA.

Customers using Office 365 are generally better protected due to built-in spoof protection. Organizations are advised to enhance their spoof protections, configure mail flow correctly, and defend against phishing attacks by implementing strong email authentication protocols (SPF, DKIM, DMARC). Successful phishing can lead to data theft, business email compromise, and significant financial losses. Microsoft provides resources and guidance for configuring protections and mitigating phishing risk.