Phishing Emails Use New Technique to Bypass Microsoft 365 Security Filters

ReliaQuest researchers observed threat actors sending phishing emails with an empty SMTP sender field to bypass Microsoft 365's RejectDirectSend protection so spoofed internal addresses can reach inboxes; attackers targeted executives and finance-facing staff with familiar business-themed lures and SVG attachments to facilitate fraudulent payments and sensitive-data theft, and defenders are advised to treat allow-listing exceptions as high-risk.