Historical intelligence backfill. This assessment covers reporting originally published on 2026-01-06 and was added to the RWP archive on 2026-09-07.
Internal-looking mail was often a routing and spoof-protection failure, not a Microsoft "Direct Send bug"
Microsoft showed phishing-as-a-service kits, including Tycoon2FA, riding misconfigured MX and spoof controls so messages appeared to come from the victim's own domain.
Bottom line up front
CONFIRMED On 6 January 2026 Microsoft described phishing actors spoofing an organization's own domain by abusing complex mail routing — MX not pointed at Exchange Online — plus spoof protections that were not strictly enforced. Volume of this vector rose from May 2025. Payloads were ordinary PhaaS, including Tycoon2FA: voicemail, shared-document, HR, and password-reset lures. Microsoft explicitly said this is not a vulnerability in Exchange Online Direct Send, contrary to some public commentary.
If users trust "it came from us," SPF/DKIM/DMARC theater without enforcement is the hole. Historical backfill of 6 January 2026 reporting; added 7 September 2026.
What happened
When MX points at a third-party gateway or on-prem and the tenant does not reject spoofed 365 mail, an actor can inject a message that looks internal. Authentication-results headers lie to the untrained eye. Users then click an AiTM kit.
Microsoft later tied the same ecosystem to Tycoon2FA's tens of millions of messages (March 2026 disruption post). Q1 2026 email-landscape notes continued credential phishing after that disruption. This January article is the mail-flow half of that problem.
Why it mattered
Secure Email Gateway projects often leave "allow internal spoof for the printer" forever. Direct Send is a legitimate device path; it is also a scapegoat. The fix is policy: who may send as the domain, where MX lives, and what happens to fail.
Who / what was affected
Tenants with split routing and weak anti-spoof. Not a CVE, so no version list. Any org that still trains users that display-name + matching domain = safe.
Technical context
Enforce DMARC p=reject when you can survive it; if you cannot, you do not own your domain for phishing purposes. Align 365 anti-spoof / impersonation policies with the real MX topology. Remove unused connectors. Do not exempt "internal" from sandboxing.
Exploitation / threat status at the time
CONFIRMED Microsoft-observed increase from May 2025; PhaaS including Tycoon2FA.
ASSESSED (high): this is configuration, not a 0-day.
UNKNOWN exact tenant count.
What defenders should have done
- Map MX, connectors, and Direct Send; document every exception.
- Turn on strict spoof protection; monitor false positives for a week, then keep it on.
- Hunt mail that claims to be from your domain but fails alignment.
- Pair with phishing-resistant MFA so a lookalike internal message still cannot steal a session cheaply.
RWP assessment
Confidence: High on Microsoft's "not Direct Send" clarification. Moderate that most enterprises with hybrid mail still have an exception that would pass this test.
Defensive actions
- DMARC enforcement project with a named owner.
- Disable unused inbound connectors.
- User training that "from us" in Outlook is not a cryptographic statement.
Sources
- Microsoft Threat Intelligence — Phishing actors exploit complex routing and misconfigurations to spoof domains
- Microsoft Threat Intelligence — Inside Tycoon2FA
- Microsoft Threat Intelligence — Email threat landscape Q1 2026