Threat Spotlight: One Blank Field Bypasses Direct Send Control

ReliaQuest reports that attackers are abusing a limitation in Microsoft 365's RejectDirectSend control by omitting the SMTP envelope sender (MAIL FROM:<>), which causes Exchange Online to accept unauthenticated messages that still show internal-looking From headers; the technique has been observed in multiple phishing campaigns targeting executives and finance roles and can bypass RejectDirectSend even while downstream spam controls may still catch some messages. The report validates the bypass in a controlled tenant, describes common lures and delivery outcomes, and recommends mitigations including IP-restricted inbound connectors, removing filtering exceptions, monitoring for empty envelope senders paired with internal From addresses, and layered detection and response.