M365 phishing campaign clusters attacks in US workday

Cybercriminals abusing Microsoft 365’s Direct Send feature concentrated malicious email activity around US Eastern business hours, according to a new analysis of a large phishing campaign tracked during July and August.

KnowBe4 Threat Lab said it identified tens of thousands of confirmed phishing messages sent through Direct Send, a legitimate Exchange Online delivery method intended for devices and applications that need to send mail without a dedicated Microsoft 365 mailbox. The researchers said the timing showed a pronounced weekday pattern, with activity strongest early in the working week and volumes rising through the morning before reaching their highest point around 2pm Eastern Time.

The campaign matters because Direct Send can allow an attacker to make a message appear to come from an organisation’s own domain without first compromising an employee account. By connecting to the target organisation’s Exchange Online MX endpoint, a sender can submit mail that is treated as anonymous internet traffic while using an address from the organisation’s accepted domain.

KnowBe4 said the operation used familiar internal-looking identities such as HR, admin, accounting, no-reply and meeting. Those names are routinely associated with workplace communications, increasing the chance that a recipient will regard the message as ordinary business traffic rather than an external lure.

The researchers said weekday volumes in their wider dataset reached roughly 22,000 to 32,000 messages a week, while weekend traffic fell sharply to about 1,500 to 2,000. August 3 and 4 each produced more than 20,000 messages in a single day, and one August email was sent to about 900 recipients at once.

About 35 per cent of the observed messages carried attachments, KnowBe4 said, with almost all of those attachments classified as threats. The team also identified 4,023 spoofed messages whose reply-to address pointed to a different domain, a technique that can divert a victim’s response to an attacker even when the visible sender address appears internal.

The sending infrastructure changed over the observation period, which the researchers interpreted as evidence that operators were rotating cloud services. Oracle Cloud accounted for the largest share of the Direct Send traffic by email volume in the dataset.

Microsoft documents Direct Send as an option for printers, scanners, line-of-business applications and other systems that can send directly to a Microsoft 365 organisation’s MX endpoint over TCP port 25. It does not require authentication and is intended only for recipients inside the organisation. Microsoft also says most customers do not need the feature and has advised administrators to use it only when legacy devices or applications cannot support other sending methods.

The company has added a RejectDirectSend control in Exchange Online that allows administrators to block this delivery method at the organisation level. Microsoft says environments that still require device or application mail can use authenticated SMTP submission or appropriately configured connectors, including controls tied to known IP addresses or certificates.

KnowBe4 advised organisations to identify Direct Send messages by examining Exchange headers, including the “X-MS-Exchange-Organization-AuthAs: Anonymous” marker, and to review whether legitimate business systems still depend on the pathway. It also recommended stronger enforcement of email authentication controls, including SPF, DKIM and DMARC, rather than leaving DMARC in monitoring-only mode.

Microsoft’s guidance similarly stresses that Direct Send assumes tenants have correctly configured sender authentication. SPF records should include authorised source addresses, while DKIM and DMARC can help distinguish permitted mail from spoofed messages. Misconfiguration, however, can leave organisations exposed to convincing messages that imitate trusted internal senders.

The campaign’s working-hour rhythm adds a social-engineering dimension to the technical weakness. Delivering messages when employees are active can make payment requests, meeting notices, document prompts or administrative messages blend more naturally into normal inbox traffic.

KnowBe4’s findings also show why traditional indicators such as an unfamiliar sender domain may be less useful against this technique. A malicious email can display the same domain used by the target organisation, while the underlying delivery path remains unauthenticated.