---
title: Hackers Exploit Microsoft 365 Feature to Send Fake Internal Emails
description: Cybercriminals are exploiting Microsoft 365's Direct Send feature to send phishing emails that appear internal, targeting US organizations. Experts recommend disabling Direct Send and enforcing strict DMARC policies.
canonical_url: https://codekeeper.co/ticker/hackers-exploit-microsoft-365-feature-to-send-fake-internal-emails
---

[Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities)

# Hackers Exploit Microsoft 365 Feature to Send Fake Internal Emails

Cybercriminals are exploiting Microsoft 365's Direct Send feature to send phishing emails that appear internal, targeting US organizations. Experts recommend disabling Direct Send and enforcing strict DMARC policies.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 6, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-microsoft-365-feature-to-send-fake-internal-emails%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-microsoft-365-feature-to-send-fake-internal-emails%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-microsoft-365-feature-to-send-fake-internal-emails%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-microsoft-365-feature-to-send-fake-internal-emails%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-microsoft-365-feature-to-send-fake-internal-emails%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-microsoft-365-feature-to-send-fake-internal-emails%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Cybercriminals are abusing Microsoft 365's Direct Send feature to bypass email security and send phishing emails that appear to come from internal users. The technique exploits a legitimate feature designed for printers and scanners, allowing attackers to evade authentication protocols like SPF, DKIM, and DMARC. Security firm StrongestLayer documented successful attacks targeting HR, finance, and executive personnel. Multiple vendors report widespread campaigns affecting over 70 organizations since May, primarily in US financial services, manufacturing, and healthcare sectors. Microsoft has acknowledged the issue and introduced detection options, but experts recommend disabling Direct Send and implementing strict DMARC policies. Source: [Dark Reading](https://www.darkreading.com/cyber-risk/phishers-abuse-m365-direct-send-to-spoof-internal-users)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-microsoft-365-feature-to-send-fake-internal-emails%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-microsoft-365-feature-to-send-fake-internal-emails%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-microsoft-365-feature-to-send-fake-internal-emails%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-microsoft-365-feature-to-send-fake-internal-emails%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-microsoft-365-feature-to-send-fake-internal-emails%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-microsoft-365-feature-to-send-fake-internal-emails%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cybersecurity Firms Hit by Klue Supply Chain Attack Tied to Extortion Group Icarus Aug 12, 2026](https://codekeeper.co/ticker/klue-supply-chain-attack-huntress-recorded-future)

[Vulnerabilities Hackers Are Actively Exploiting a Critical WordPress Flaw — Update Now Sep 25, 2026](https://codekeeper.co/ticker/wordpress-vulnerability-cve-2026-87902)

[New 'Bucket Hijacking' Attack Can Silently Reroute Your Cloud Data to Hackers Aug 12, 2026](https://codekeeper.co/ticker/cloud-bucket-hijacking-attack-prevention)

[Levi Strauss Hit by Social Engineering Cyberattack Aug 11, 2026](https://codekeeper.co/ticker/levi-strauss-data-breach-social-engineering)