Cloud Email Filtering Bypass Attack Works 80% of the Time

Researchers presented a paper showing that common cloud-based email filtering setups are frequently misconfigured—allowing attackers to bypass filters in ~80% of examined Google- and Microsoft-hosted domains—which substantially increases phishing risk; the paper details causes (confusing/incomplete vendor documentation and permissive admin settings) and recommends mitigations (restrict mail acceptance to filter IPs, properly configure SPF/DKIM/DMARC, and use ARC).