Hackers Exploit Microsoft 365 Direct Send to Evade Filters and Steal Data

Cybercriminals are increasingly exploiting a legitimate Microsoft 365 feature designed for enterprise convenience, turning Exchange Online's Direct Send into a vector for phishing and business email compromise attacks.

Security researchers have observed that malicious actors leverage this pathway to bypass authentication checks and deliver messages that evade traditional security controls.

Microsoft 365 Exchange Online's Direct Send was developed to address a practical enterprise challenge. Devices and legacy applications, such as multifunction printers, scanners, and older software, need to send email within corporate networks but lack modern authentication capabilities.

Direct Send allows these devices to bypass rigorous authentication and security screening, preserving business workflows. However, this has become an exploitable vulnerability. Cisco Talos and other security vendors have reported increased malicious activity leveraging Direct Send for phishing campaigns and business email compromise attacks.

Microsoft has acknowledged these security implications and introduced a Public Preview of the RejectDirectSend control, signaling future improvements such as Direct Send-specific usage reports and a potential "default-off" posture for new tenants.

How Attackers Exploit the Trusted Pathway

Direct Send abuse involves the exploitation of a trusted communication channel. Attackers emulate legitimate device or application traffic, sending unauthenticated messages that appear to originate from internal accounts.

Research reveals that attackers frequently impersonate internal users, executives, or IT help desks. Business-themed social engineering lures, such as task approvals and payment prompts, are common.

Modern attacks incorporate techniques to evade content filters, such as QR codes embedded in PDFs and obfuscated attachments, which redirect victims to credential harvesting pages.

The core vulnerability lies in Direct Send's exemption from standard email domain sender verification. Authentication mechanisms like DKIM, SPF, and DMARC typically protect email recipients, but Direct Send bypasses these checks.

Real-world examples include spoofed notifications that bypassed sender verification due to Direct Send, allowing malicious messages through.

This creates challenges for enterprises, as many organizations rely on Direct Send for legacy systems. Disabling it without proper planning may disrupt business operations.

To counter Direct Send exploitation, security experts recommend a layered defense strategy. Organizations should disable or restrict Direct Send where feasible, beginning with a thorough inventory of current dependencies.

Administrators should review internal device inventories, SPF records, and connector configurations. Microsoft has provided tools to enable the RejectDirectSend control.

Migration to authenticated SMTP is the most secure long-term solution. Organizations should adopt authenticated SMTP client submission on port 587 for devices capable of storing modern credentials.

For devices unable to use authenticated submission, deploy SMTP relays with tightly scoped source IP restrictions.

Strengthening authentication and alignment provides additional protection. Maintain SPF with authorized sending IPs and enforce DKIM signing. Monitor DMARC reports for unauthenticated traffic.

Enhance policy, access, and monitoring to restrict unauthorized SMTP traffic. Use Conditional Access policies to block legacy authentication paths and configure alerts for unexpected internal domain messages.

These defenses, combined with platform controls, aim to reduce attacker dwell time and improve detection-to-remediation as organizations work to secure this feature.

Based on reporting by GBHackers.