Microsoft 365 Phishing Technique Exploits Blank Envelope Sender to Evade Detection
A novel phishing technique is bypassing Microsoft 365 security by leaving the SMTP envelope sender blank, allowing unauthenticated messages to appear as if sent from within an organization.
Cybercriminals are employing a sophisticated phishing technique that exploits a subtle loophole in Microsoft 365's email security, specifically targeting the Direct Send functionality. This method involves leaving the SMTP envelope sender field blank, a maneuver that allows unauthenticated emails to bypass the RejectDirectSend control. This control is designed to block emails that claim to originate from an organization's domain but are sent without proper authentication. By omitting the sender's domain from the envelope, attackers circumvent this security measure, creating a pathway for spoofed messages that appear to originate from within the victim's own organization.
Researchers at ReliaQuest identified this pattern in active phishing campaigns and successfully reproduced it within a Microsoft 365 tenant. Their findings indicate that this technique has been observed across multiple unrelated organizations over the past year. The effectiveness of this method lies in its ability to impersonate internal communications, making phishing lures such as fake document notifications, payment requests, or voicemail alerts highly convincing to unsuspecting employees. While email filters may catch some attempts, any message that reaches a recipient's inbox presents a significant risk, potentially leading to credential theft, malware deployment, fraudulent financial transactions, and broader account compromise.
The Direct Send feature in Microsoft 365 allows authorized devices and applications to send emails within the same tenant without requiring full authentication. The RejectDirectSend control was implemented to mitigate risks associated with unauthenticated Direct Send messages that spoof internal domains. However, the new technique exploits the fact that the RejectDirectSend control specifically checks the domain in the envelope sender against the organization's accepted domains. When the envelope sender is left blank (using the MAIL FROM:<> command), there is no domain for the control to evaluate, thus failing to trigger the rejection condition.
While the bypassed control is a critical step, it's important to note that messages sent using this technique are not guaranteed to reach the inbox. In ReliaQuest's testing, the messages were classified as anonymous, received a high Spam Confidence Level (SCL 9), and were typically routed to the Junk Email folder after failing sender authentication checks like SPF, DKIM, and DMARC. However, the actual delivery outcome can vary significantly based on the email's content, the organization's specific security configurations, and any exceptions in place, such as trusted sender lists.
ReliaQuest's analysis of phishing examples between September 2025 and August 2026 revealed that attackers are specifically targeting roles such as executives, managers, finance staff, procurement teams, and customer-facing personnel. These individuals are prime targets because they regularly handle sensitive business communications involving invoices, bids, shared files, and payment instructions, making deceptive emails appear legitimate. Common lures included file-sharing notifications, payment requests, procurement invitations, and even SVG attachments disguised as voicemail recordings, echoing previous trends of weaponized SVG files used in phishing.
To defend against this evolving threat, security teams are advised to maintain the RejectDirectSend control but not rely on it as a sole defense. Implementing IP-restricted inbound connectors is crucial, as this permits unauthenticated Direct Send only from explicitly approved devices and applications, effectively blocking all other attempts, including those with blank envelope senders. Furthermore, organizations must meticulously review and remove any unjustified filtering exceptions, such as allowed sender lists, allowed domains, or safe sender entries, which can inadvertently override security checks.
Organizations should also prioritize searching for and alerting on emails that exhibit an empty envelope sender paired with a visible 'From' address belonging to an accepted internal domain, especially when sender authentication checks like SPF, DKIM, or DMARC have failed but the email still reached an inbox, potentially due to an override. Finally, end-users play a vital role by verifying any unexpected requests for payments, documents, or access through a separate, trusted communication channel before taking any action or opening attachments. This layered approach, combining technical controls with user vigilance, is essential to combatting sophisticated phishing tactics.