Ghost-Sender Flaw Exposes Exchange Online Users to Sender Spoofing Attacks

Ghost-Sender is a vulnerability in Exchange Online that enables large-scale email spoofing by bypassing SPF/DKIM/DMARC protections in environments using external MX records or third-party filtering. Researchers demonstrated simple SMTP/PowerShell exploitation, found significant exposure among tested tenants, and observed signs of active exploitation; recommended mitigations include strict Partner Organization connectors, transport rules, disabling Direct Send where appropriate, and validating defenses with the public testing tool.