Phishers Abuse Microsoft 365 to Spoof Internal Users

Cybercriminals are exploiting Microsoft 365's Direct Send feature to send unauthenticated emails that look like internal messages, allowing them to bypass SPF/DKIM/DMARC and evade Microsoft Defender and third-party secure email gateways; multiple vendors (Varonis, Barracuda, Arctic Wolf, StrongestLayer) have observed widespread campaigns delivering phishing via malicious QR-code PDFs and obfuscated HTML/SVG, primarily targeting U.S. organizations in finance, manufacturing, and healthcare. Recommended mitigations include enabling Microsoft's Reject Direct Send setting, enforcing strict DMARC, deploying header stamping for internal messages, and quarantining unmarked mail.