How Attackers Exploit Microsoft 365’s Direct Send to Slip Past Email Security

Security researchers have uncovered a sophisticated spear phishing campaign that exploits Microsoft 365’s Direct Send feature to bypass traditional email authentication and deliver personalized credential harvesting attacks.

The discovery, made through collaboration between StrongestLayer’s AI system and a manufacturing company’s security team, reveals how attackers are weaponizing legitimate email infrastructure to conduct highly targeted attacks.

Direct Send Vulnerability Enables Authentication Bypass

The attack campaign leverages Microsoft 365’s Direct Send functionality to circumvent standard email security measures.

Unlike typical phishing attempts, these malicious emails appear to originate from within the target organization’s email infrastructure, explicitly using the company.mail.protection.outlook.com thoughtful host to deliver messages.

“The emails were failing SPF and DMARC checks, but because they came through our internal smart host via Direct Send, they were being treated as trusted internal traffic,” explained Jeremy, a Security Architect who investigated the attacks alongside StrongestLayer researchers.

Forensic analysis revealed key indicators including authentication failures across SPF, DKIM, and DMARC protocols, suspicious IP addresses from generic hosting providers, and mail paths showing unauthenticated submission through Microsoft’s SmtpServer.Submit process.

The attackers used PowerShell scripts to initiate the Direct Send exploitation, allowing them to send emails that appeared legitimate while failing basic authentication checks.

Advanced Obfuscation and Dual-Payload Strategy

The campaign employed sophisticated evasion techniques to bypass traditional security filters.

Instead of relying on text-based phishing content, attackers embedded entire call-to-action messages within high-fidelity images mimicking legitimate voicemail notifications from services like RingCentral.

The attack utilized two distinct payload types: HTML files and SVG files, both heavily obfuscated. The HTML variant employed a three-stage attack process using an invalid image tag to trigger JavaScript execution:

xml<img src="#" onerror="(new Function(atob(this.dataset.scolding)))()" 
     data-scolding="[Base64-encoded malicious script]">

The SVG backup payload exploited the fact that many security systems treat .svg files as harmless images despite their JavaScript execution capabilities.

Personalization Amplifies Attack Effectiveness

What distinguished this campaign from standard phishing attempts was its hyper-personalization capabilities.

The malicious JavaScript dynamically pulled victims’ corporate logos and official branding to create authentic-looking credential harvesting pages, using the victims’ email addresses to pre-fill login forms and establish false trust through familiar visual elements.

Microsoft has responded by introducing a “Reject Direct Send” setting in Exchange Admin Center as of April 2025.

Security teams are advised to implement defense-in-depth strategies, including strict DMARC policies, enhanced header analysis, and treating HTML/SVG attachments from external senders as high-risk. Organizations not actively using Direct Send should disable the feature immediately.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates