Phishing Attacks Exploit Misconfigured Email Routing Settings to Target Microsoft 365 Users

Microsoft Threat Intelligence reports a widespread rise in phishing campaigns that abuse complex mail routing and misconfigured MX records to spoof internal corporate domains and bypass Office 365 spoof protections. Attackers send convincing HR/IT-themed messages and fake invoices to harvest credentials and enable BEC or financial fraud, often using phishing-as-a-service kits (e.g., Typhoon2FA). Microsoft recommends correcting MX records to point to Office 365, enforcing DMARC, and using MFA—preferably phishing-resistant MFA for privileged accounts—to mitigate the risk.