Threat Actors Exploit Misconfigurations to Spoof Internal Emails

Microsoft researchers observed a surge (since May 2025) of phishing attacks that abuse complex routing misconfigurations and spoof-protection errors to send emails that appear internal; actors are largely using the Tycoon2FA PhaaS and AiTM techniques to bypass MFA and harvest credentials, resulting in elevated risk of data theft, BEC, and financial loss.