Microsoft Warns: Misconfigured Email Routing Enables Internal Domain Phishing

Microsoft’s Threat Intelligence team has issued a warning about a surge in phishing campaigns exploiting misconfigured email routing and spoof protections. These attacks allow threat actors to impersonate an organization’s own domain, making malicious emails appear as if they were sent internally.

How the Attack Works

• Misconfigured routing:
  • Occurs when MX records point to on-premises Exchange servers or third-party services before reaching Microsoft 365.
  • Creates a gap where spoofed emails bypass protections.
• Spoofed internal emails:
  • Messages appear to come from the same domain (same “To” and “From” fields).
  • Lures include: voicemails, HR communications, password resets, shared documents.
• Phishing-as-a-Service (PhaaS):
  • Campaigns often use Tycoon 2FA kit, which Microsoft blocked over 13 million malicious emails from in October 2025.
  • Kits provide ready-made templates, infrastructure, and adversary-in-the-middle (AiTM) techniques to bypass MFA.

Impact

• Credential theft: Stolen usernames/passwords enable further compromise.
• Business Email Compromise (BEC): Attackers impersonate executives or finance staff to trick organizations into wiring funds.
• Financial scams: Spoofed emails may include:
  • Fake invoices requesting large payments.
  • IRS W-9 forms with stolen identities.
  • Fake bank letters to legitimize fraudulent accounts.
• Trusted brand impersonation: DocuSign, HR departments, and internal systems are mimicked to increase credibility.

Defensive Measures

• Email authentication:
  • Enforce strict DMARC reject policies.
  • Configure SPF hard fail.
• Connector configuration:
  • Properly set up third-party spam filters and archiving tools.
• MX record best practice:
  • Point MX records directly to Office 365 to avoid routing gaps.
• Direct Send:
  • Disable unless absolutely necessary to prevent spoofing.
• User awareness:
  • Train staff to spot suspicious “internal” emails with unusual attachments or QR codes.

Takeaway

This campaign underscores how misconfiguration, not just malware, can open doors to phishing. By exploiting routing gaps and spoof protections, attackers make malicious emails look like trusted internal communications. Organizations must tighten email authentication policies and routing configurations to close this loophole.