Hackers Exploit Routing Misconfigurations to Successfully Spoof Organizations

Microsoft Threat Intelligence reports a widespread phishing and domain-spoofing campaign (active since May 2025) that abuses complex mail routing and misconfigured DMARC/SPF to make emails appear internal; threat actors are using the Tycoon2FA PhaaS and AiTM techniques to steal credentials and execute financial invoice fraud, with Microsoft Defender blocking millions of related messages and recommending strict DMARC/SPF policies, connector hardening, ZAP, Safe Links, and phishing-resistant MFA.