Microsoft Warns of Surge in Internal Domain Spoofing

A wave of sophisticated phishing attacks is hitting organisations by exploiting the trust users place in emails that appear to come from their own colleagues, according to Microsoft Threat Intelligence. The report details how threat actors are using complex mail routing scenarios to bypass filters and deliver convincing “internal” emails that are anything but, with a sharp uptick since May 2025.

Attacks rely on misconfigured spoof protections in organisations that do not route mail directly through Office 365, targeting tenants whose MX records point to on-premises Exchange servers or third‑party gateways rather than Microsoft 365.

Phishing actors are exploiting these routing configurations to spoof domains and deliver emails that superficially look internal, with the strategy supported by the Phishing-as-a-Service economy and Tycoon2FA tooling for Adversary-in-the-Middle operations capable of bypassing MFA; in October 2025 Microsoft blocked over 13 million malicious emails tied to Tycoon2FA.

The lures include HR communications, IT alerts and fake invoices, while attackers have even fashioned messages that imitate threads between senior executives to prompt financial losses. Microsoft urges administrators to stop relying on implicit trust and to enforce explicit authentication, including DMARC reject and SPF hard fail policies and careful configuration of third‑party connectors.

The piece notes the distinction that this is not a vulnerability in Direct Send, but a manipulation of how emails are authenticated in complex environments. 7 January 2026.