Microsoft Exchange Flaw Lets Attackers Spoof Any Email Address

InfoGuard reported a widespread Exchange Online/hybrid misconfiguration called "Ghost-Sender" that lets attackers send emails appearing to come from any internal or external address (including CEO or noreply accounts) by leveraging external MX records; SPF/DKIM/DMARC are ineffective in this scenario. The issue is trivial to exploit (a one-line PowerShell) and researchers say Microsoft acknowledged related active abuse; mitigations (partner connector, mail flow rules, disabling Direct Send) exist but are underapplied across organizations.