Microsoft Warns of Surge in Internal Domain Spoofing

Microsoft Threat Intelligence reports a surge in sophisticated phishing campaigns that exploit complex mail routing and misconfigured spoof protections to spoof internal domains and deliver convincing phishing emails. Attackers are using the Tycoon2FA Phishing-as-a-Service platform to perform AiTM/MFA-bypass attacks, resulting in credential theft and targeted financial fraud; Microsoft recommends enforcing strict DMARC/SPF policies and properly configuring third-party connectors.