Over the past three months, our threat analysts have noticed a significant spike in attackers abusing Microsoft 365’s Direct Send feature—a tool intended for devices like printers or scanners to send internal emails without authentication. Unfortunately, threat actors have found a way to exploit this convenience, slipping past critical email security checks like SPF, DKIM, and DMARC.
Since May 2025 alone, attackers have compromised over 70 organizations across the U.S., hitting hard in sectors like manufacturing, consulting, and healthcare. These emails appear completely internal, often evading Microsoft’s built-in defenses and traditional Secure Email Gateways (SEGs).
The below information is intended to help you avoid this sort of compromise and take the necessary precautions to protect your organization from this growing risk.
Exploiting Direct Send doesn't require advanced hacking skills. Here’s how attackers do it:
Since Direct Send doesn't validate SPF, DKIM, or DMARC, emails sent using this method often appear trustworthy to both systems and users.
This technique is particularly dangerous because it closely mimics legitimate operational email behavior. Since many organizations permit unauthenticated devices like scanners and copiers to utilize Direct Send for internal convenience, the malicious traffic easily blends in. This makes it challenging for traditional SIEM or EDR tools to identify anomalies in real-time.
The attached PDFs often imitate fax notifications, voicemail alerts, or financial documents—formats recipients rarely question. Given their Microsoft-based origin and the absence of URLs or malware, these emails consistently evade standard email filters and Secure Email Gateway (SEG) policies.
Attackers exploit Microsoft 365’s Direct Send feature, which originally allowed internal devices like printers to email without authentication. Using publicly available tenant naming conventions and predictable email formats, threat actors deploy PowerShell scripts to send internal-looking spoofed messages.
This method does not require compromised accounts or special privileges, just knowledge of common internal sender naming conventions. Because these spoofed emails originate from familiar-looking addresses without clear compromise indicators, they're highly effective at bypassing built-in security measures.
Certain variants of this campaign utilize synthetic or AI-generated content, including fraudulent HR announcements and fake executive communications. Some attachments even contain manipulated audio files or convincing SharePoint links to boost user engagement rates further.
These carefully crafted messages exploit inherent human trust in internal communications by featuring visually polished formatting and recognizable branding. Since these messages rarely contain detectable malicious code, traditional text-based and signature-based detection methods frequently fail to flag them.
All three of these tactics are purposefully designed to slip past text-based filters and signature-based detection.
Direct Send bypasses core validation checks like SPF, DKIM, and DMARC because it’s designed for trusted internal devices. As a result, threat actors can send spoofed emails that appear legitimate without triggering authentication-based security controls.
Since these emails originate from Microsoft’s infrastructure, they often inherit trusted sender status by default. Many native and third-party tools interpret this traffic as internal, which limits the scrutiny applied during scanning and routing.
QR codes and image-based links embedded in PDFs or HTML files often go undetected by traditional scanners. These payloads sidestep typical defenses that rely on visible URLs or known malicious signatures.
Attackers mimic legitimate internal email patterns, such as short messages or blank bodies with expected attachments. This lowers suspicion from end users, who are conditioned to trust internal communications that look routine.
IRONSCALES has identified a broad trend emerging across Microsoft 365 environments: attackers impersonating internal communications to deliver credential theft or initiate business email compromise (BEC). Direct Send is a key enabler of this trend.
These attacks are:
Microsoft 365’s Direct Send is increasingly being exploited by attackers who understand how to leverage overlooked infrastructure gaps. These attacks often use minimalistic tactics, such as empty email bodies and QR-coded PDF attachments, specifically designed to evade traditional email security tools.
To mitigate these threats, organizations should enforce strict email authentication policies, disable or tightly restrict the use of Direct Send functionality, and implement advanced scanning technologies capable of detecting hidden malicious content within attachments. Regular training sessions to educate employees about evolving phishing techniques can further strengthen your organization's defenses.
Have questions about safeguarding your organization from Direct Send abuse? Reach out! We’re here to help.