Spoofing Microsoft 365 Like It’s 1995

This report explains how Microsoft 365's Direct Send feature (unauthenticated SMTP via company-com.mail.protection.outlook.com) can be abused to spoof trusted internal/external senders and deliver phishing emails into enterprise inboxes. The author provides PoC PowerShell commands, discusses mail flow and Exchange Online Protection behavior, warns about attachment/attachment-filtering limits and IP banning, and recommends defenders validate mail gateway configurations and trusted sender handling to mitigate this attack path.