Phishing actors exploit complex routing and misconfigurations to spoof domains

Microsoft Threat Intelligence describes widespread phishing campaigns that abuse complex mail routing and improperly configured SPF/DMARC/DKIM or third-party connectors to spoof internal senders, delivering credential-phishing and invoice-fraud lures via PhaaS platforms (notably Tycoon2FA) and AiTM flows; the report includes header examples, IOCs, hunting queries, and mitigation/remediation guidance to prevent and respond to these attacks.