Proofpoint Security Breach: Hackers Send Millions of Phishing Emails

Threat actors exploited a Proofpoint configuration and compromised Office365 accounts to relay millions of phishing emails that bypassed DKIM/SPF and impersonated brands like Disney and IBM. The campaign used Proofpoint's permissive trust of Office365 IPs and target domain MX lookups to deliver convincing spoofed messages; Guardio Labs discovered the activity and Proofpoint deployed mitigations (including an X-OriginatorOrg header and admin alerts).