Misconfigured email routing enables internal-spoofed phishing

Misconfigured email routing and weak/absent email authentication allow phishing actors to spoof internal messages and deliver credential-stealing pages (notably via PhaaS platforms such as Tycoon2FA), sometimes enabling MFA bypass and facilitating BEC/financial scams; Microsoft advises enforcing DMARC reject and SPF hard-fail, enabling DKIM, and correctly configuring third-party connectors and MX records to mitigate the risk.