Complex Routing, Misconfigurations Exploited for Domain Spoofing in Phishing Attacks

Threat actors have been observed spoofing legitimate domains to make phishing emails appear internal, using complex routing and misconfigured domain protections to their advantage. The attack vector has been employed in opportunistic campaigns powered by phishing-as-a-service (PhaaS) platforms such as Tycoon2FA, targeting several industries.

The phishing messages use lures related to document sharing, HR communications, invoices, password resets, and voicemails, with credentials then used for business email compromise or data theft. According to Microsoft, vulnerable organisations have configured intricate routing and spoof protections poorly, and MX records that do not point to Office 365, enabling messages to seem as if they originate from the victims’ domains.

The company notes that this is not a vulnerability of Direct Send, the Microsoft 365 Exchange Online feature that allows sending emails without authentication. In October 2025, Microsoft blocked over 13 million malicious emails from the Tycoon2FA platform, many spoofing internal domains.