Microsoft 365 Direct Send Bypass Lets Attackers Spoof Internal Users Without Credentials

Gbhackers •Mayura Kathir • September 4, 2026

A Microsoft 365 email security-control bypass that lets attackers submit unauthenticated messages posing as internal users by leaving one SMTP field blank. The technique targets Exchange Online’s RejectDirectSend setting and does not represent a vulnerability in Microsoft software or in ReliaQuest systems; instead, it exposes a limitation in how the control evaluates Direct Send traffic. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Attacks Exploit Microsoft 365 Direct Send Bypass Cyber attackers are using an 'empty envelope' technique to bypass Microsoft 365's RejectDirectSend control, allowing unauthenticated emails to reach organizational inboxes. This method targets senior leaders and utilizes a blank Simple Mail Transfer Protocol (SMTP) envelope sender, which tricks the system into accepting the emails. Between September 2025 and August 2026, 40% of these phishing emails were aimed at senior leaders, with common lures including document notifications and payment requests. While not a vulnerability in Microsoft software, this limitation exposes organizations to increased spearphishing risks. Testing showed that using IP-restricted inbound connectors can effectively block these attempts. Organizations are advised to monitor for empty envelope attacks and tighten email filtering protocols. 7 sources 63

Extracted Entities

Microsoft 365 Direct Send Bypass Lets Attackers Spoof Internal Users Without Credentials

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)