Phishing Frenzy: Microsoft 365 Direct Send Exploited in US Firm Attacks
Scammers are exploiting Microsoft 365 Direct Send, a feature intended for internal devices, to spoof internal emails and bypass security filters. Armed with minimal public info, they send phishing emails mimicking voicemails with QR codes. Over 70 U.S. organizations have been targeted. Stay alert for external IPs and strange email behaviors!
Hot Take:
Who knew that Microsoft 365’s Direct Send feature would become the new playground for cybercriminals? It seems like even the most mundane tools can be turned into weapons in the hands of crafty scammers. So, if you start receiving voicemails from your fridge or printer, it’s not because they’ve finally become sentient—it’s probably just another phishing attack!
Key Points:
- Scammers are exploiting Microsoft 365’s Direct Send to spoof internal emails.
- Over 70 organizations have been targeted, with 95% being US-based.
- Attackers use fake voicemails with QR codes to phish credentials.
- Detection methods include checking email headers for anomalies.
- Defense strategies involve rejecting Direct Send and enforcing MFA.
Already a member? Log in here