Microsoft 365 users are facing a phishing technique built on a small change: attackers leave the SMTP envelope sender blank.
The omission can let an unauthenticated message pass a Direct Send safeguard while showing employees an address that appears to belong to their own organization.
The approach is not a Microsoft software flaw and does not need a stolen account. It exploits how Exchange Online’s RejectDirectSend control checks the domain in the envelope sender, rather than the address displayed in the visible From field.
That difference offers criminals a simple route to impersonation. It removes a barrier designed to stop an especially risky form of spoofed mail.
Researchers at ReliaQuest identified the pattern in active phishing cases and reproduced it in a controlled Microsoft 365 tenant.
Reliaquest said in a report shared with Cyber Security News (CSN), the company said the technique had appeared repeatedly across unrelated organizations during the past year. A convincing internal-looking email can carry a document notice, payment request, or voicemail lure.
Even if mail filters detect some attempts, any message that reaches a recipient creates an opening for credential theft, malware delivery, fraudulent transfers, and wider account compromise.
Microsoft 365 Phishing Technique Uses Empty Envelope Sender
Direct Send allows devices and applications to send mail within the same Microsoft 365 tenant without authentication. Earlier coverage of Microsoft 365 Direct Send documented attackers imitating internal users without compromising an account.
RejectDirectSend is meant to reject unauthenticated Direct Send mail claiming to come from an organization’s accepted domain. ReliaQuest sent two messages to a tenant’s mail host.
The message using the tenant domain in its envelope sender was rejected, but one using the SMTP command MAIL FROM:<> was accepted and queued.
The recipient still saw the same internal IT support address in the visible From field. Since the empty sender holds no domain, RejectDirectSend has nothing to compare with the tenant’s accepted domains.
The control therefore does not apply its rejection condition, although the message came from an unauthenticated external source.
Acceptance does not mean inbox delivery. Microsoft 365 marked the test message anonymous, gave it a Spam Confidence Level of 9, and sent it to Junk Email after SPF and DKIM returned no result and DMARC failed.
Yet filtering outcomes can differ based on content, infrastructure, configuration, and trusted-sender exceptions. In one case, a message that failed every sender-authentication check was classed as high-confidence phishing but reached an inbox because the spoofed executive was an allowed sender.
Organizations following email authentication configuration guidance should also review exceptions that can override checks.
Targeting and Defensive Steps
ReliaQuest examined examples from September 2025 to August 2026 targeting executives, managers, finance staff, procurement teams, and customer-facing roles. These people regularly handle invoices, bids, shared files, and payment instructions, making business language convincing.
File-sharing notices were most common, followed by payment and remittance requests, procurement invitations, loan or investment offers, and meeting invitations. Some messages used SVG attachments disguised as voicemail recordings.
That approach echoes coverage of weaponized SVG phishing files, which can trigger browser redirection rather than act as images. Security teams should retain RejectDirectSend but not view it as a complete defense.
An IP-restricted inbound connector permits unauthenticated Direct Send only from approved devices and applications. It blocked every Direct Send attempt, including those with a blank sender envelope.
Administrators should identify systems that truly need Direct Send and tightly restrict approved source IP addresses.
Remove unjustified filtering exceptions, including allowed senders, allowed domains, safe-sender entries, and rules that change spam scores. Previous internal email spoofing cases show why trusted routes and permissive rules need scrutiny.
Finally, defenders should search for an empty envelope sender paired with a visible From address in an accepted internal domain, which differs from bounce mail. Prioritize alerts where SPF, DKIM, or DMARC also failed but delivery occurred through an override.
Employees should verify unexpected payment, document, or access requests using a known channel before acting. This check should occur first before responding or opening attachments.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
The post Microsoft 365 Phishing Technique Uses Empty Envelope Sender to Evade Direct Send Blocking appeared first on Cyber Security News.