Microsoft 365 Direct Send Abuse: A Phishing Blind Spot

Attackers are using a legitimate Microsoft 365 feature called Direct Send to fire off emails that look like they came from inside your own company. The messages skip your spam filters because Microsoft treats them as internal traffic. Your employees see a familiar internal address and trust it.

The fix is one setting. The risk, if you don't know the feature exists, is that a spoofed email walks straight past every control you paid for.

By Joel Baum. The NetSys Group has delivered managed IT, cybersecurity, and cloud services since 1998. Our engineers hold degrees in electrical and computer engineering and are certified Microsoft and Cisco instructors, serving businesses across NY, NJ, CT, PA, and Southwest Florida.

What is Direct Send, and why does it exist?

Direct Send is a Microsoft 365 feature built for devices, not people. Printers, scanners, and line-of-business apps use it to send email — think a copier that emails a scanned PDF, or an app that sends automated alerts — without a real mailbox or password. They route mail through your tenant's smart host, an address that looks like yourcompany-com.mail.protection.outlook.com.

It's convenient. It's also unauthenticated by design, and that's the hole.

How does the Direct Send phishing attack work?

Attackers point PowerShell at your smart host and send email that claims to be from one of your own users, no login required. Because the message rides your tenant's own mail path, it inherits the trust of internal traffic and often sails past SPF, DKIM, and DMARC checks. The recipient sees a coworker's address, not a stranger's.

The Varonis security team documented an active campaign doing exactly this. The lures impersonate voicemail or fax notifications with subject lines like "Caller Left VM Message," and the attached PDF carries a QR code that leads to a fake Microsoft login page built to steal credentials.

Who is getting hit?

Varonis Threat Labs, which uncovered the campaign, found it has targeted more than 70 organizations since it started in May 2025, with victims that were predominantly US-based and spread across multiple industries. The activity was also reported by BleepingComputer.

That's the SMB profile exactly — the regulated, email-heavy businesses that can least afford a wire sent to the wrong account. This is a close cousin of business email compromise, except the attacker never has to break into an account first.

Why do these emails get past your filters?

Because everything about them says "internal." The mail comes through your own Microsoft 365 smart host, the from-address is a real name at your real domain, and many filters give internal-looking mail a lighter touch. An employee who'd hesitate over a message from an outside address doesn't blink at one that appears to come from the person two desks over.

Standard email authentication helps but doesn't fully close it on its own, which is why this technique has worked as long as it has.

How do you shut Direct Send abuse down?

Start with the control Microsoft added for exactly this problem: the Reject Direct Send setting in the Exchange admin center. Turn it on and unauthenticated messages sent to your smart host get rejected. Most small businesses don't actually rely on Direct Send, so flipping it off costs nothing.

Then tighten the rest:

• Enforce DMARC at p=reject so spoofed mail is dropped, not just flagged.
• Set SPF to hardfail (-all) rather than softfail.
• Turn on anti-spoofing policies in Microsoft Defender for Office 365.
• Train people on QR-code lures and voicemail or fax "notifications" that ask you to scan or log in.

If you do use Direct Send for a printer or an app, don't just kill it — move that device to authenticated SMTP or a proper mail connector first, then reject the rest. Getting this configured correctly is bread-and-butter managed cybersecurity work.

Frequently asked questions

Will turning off Direct Send break our printers or scanners?

Only if those devices actually use Direct Send to send mail. Many don't. Before you enable Reject Direct Send, check what's routing through your smart host, then move any legitimate device to authenticated SMTP or a mail connector. Done in that order, nothing breaks and the phishing path closes.

Is this the same as business email compromise?

It's related but not identical. In classic business email compromise, the attacker gets into a real mailbox first. Direct Send abuse skips that step — no password needed — because the feature accepts unauthenticated mail by design. The result looks the same to your employee: a trusted internal email that isn't.

Won't DMARC alone stop these emails?

Not reliably on its own. That's part of why the technique spread. A strict DMARC policy set to reject helps a lot, but the durable fix is enabling Reject Direct Send at the tenant level so the unauthenticated path is closed, then layering DMARC, SPF hardfail, and anti-spoofing on top.

How do we know if we've been targeted?

Look for inbound mail that claims to be internal but arrived through your smart host, especially voicemail or fax-themed messages with PDF attachments containing QR codes. Message trace in Exchange and your Defender reports will show it. If you're not sure what to look for, that's a review worth having a professional run.

Want to know whether Direct Send is open on your tenant right now? Ask NetSys for a complimentary Microsoft 365 security review and we'll check this and the rest of your email defenses.