KnowBe4 Flags M365 Direct Send Phishing

Phishing emails that bypassed normal email security gateways by abusing a legitimate Microsoft 365 feature were observed arriving in a pattern that followed the US Eastern workweek, according to a report from KnowBe4's Threat Lab team. The researchers said the campaign relied on the Direct Send function to make messages appear to come from trusted internal addresses.

Abusing a trusted mail path

Direct Send is a built-in Microsoft 365 capability that lets devices such as printers and scanners, along with legacy applications, send email without a dedicated account. Attackers turned that function against organizations, using it to send messages that looked like they originated from internal addresses such as HR, accounting or admin.

Because the messages entered through a trusted path, the technique let the attackers deliver malicious payloads without compromising an employee account or stealing credentials. It also allowed them to bypass an organization's normal email security gateway by connecting directly to its Exchange Online MX endpoint.

The KnowBe4 report, published on September 10, described how authentication checks can still fail to stop the messages. "While authentication checks may detect that something is wrong, organizations using a domain-based message authentication, reporting and conformance (DMARC) monitoring policy can still allow the message to be delivered," the report said.

While authentication checks may detect that something is wrong, organizations using a domain-based message authentication, reporting and conformance (DMARC) monitoring policy can still allow the message to be delivered

— the KnowBe4 report

Volume and timing of the campaign

KnowBe4 researchers said they observed 29,785 confirmed phishing emails abusing Direct Send across July and August 2026. The delivery timing followed what the researchers described as a distinctly human pattern.

Attackers were particularly active from Monday to Tuesday during US Eastern business hours, with volumes peaking just before noon, dipping and then reaching their highest point at around 2pm EST, according to the report.

The KnowBe4 report included a chart of daily Direct Send volume from July 1 to August 12, 2026, which showed sharp weekday peaks and near-zero weekends.

What the malicious emails carried

Approximately 35% of the emails KnowBe4 classified as phishing carried attachments, and the researchers said virtually all of those attachments were classified as threats.

The messages used a range of familiar lures, including fake document requests, internal voicemail alerts, invoices and payment approvals, and fake OneDrive file shares.

In addition to malicious attachments, 4023 of the malicious emails used a reply-to address pointing to a different domain, which routed employee responses directly to the attacker. In one instance, a phishing email reached 900 recipients in a single send.

Detection signs in Exchange headers

To help organizations spot this type of campaign, the KnowBe4 researchers recommended looking for the Exchange header “X-MS-Exchange-Organization-AuthAs: Anonymous,” which they described as a sign that an email arrived through an unauthenticated delivery path.

That header check gives security teams a concrete indicator to hunt for when reviewing mail flow, rather than relying only on the apparent sender address, which can look internal.

Hardening DMARC, connectors and DKIM

The report outlined several steps organizations can take to reduce exposure to Direct Send abuse.

• Enforce a strict DMARC policy by changing it from p = none to p = reject, which blocks spoofed messages claiming to come from your domain.
• Restrict legitimate senders through Exchange Online connectors, allowing only approved IP addresses.
• Close the Direct Send pathway if it is not required.
• Enable DomainKeys identified mail (DKIM) signing to verify outbound emails and give DMARC the information needed to detect and reject unauthorized messages.

Why the report stands out

The findings are based on data collected by a single vendor, and the underlying campaign has not been independently confirmed by Microsoft or additional security firms. The absence of independent confirmation means these findings should be treated as one vendor's observation.

The KnowBe4 research nonetheless adds detail to a known abuse pattern: a legitimate mail-sending capability repurposed to deliver messages that appear internal, with the volume of those messages recorded over a defined period.

What defenders should consider

For organizations running Microsoft 365, the report's recommendations point to configuration choices that are within a security team's control. Tightening DMARC from monitoring to enforcement, limiting which IP addresses can relay mail through Exchange Online connectors, and disabling Direct Send where it is not needed are all steps that can be taken without replacing existing email security tools.

The reply-to mismatch observed in 4023 messages also highlights a less obvious risk: when employees respond to a phishing email, those replies can be directed straight to an attacker-controlled domain. Verifying reply-to addresses and training staff to treat unexpected internal requests with caution could reduce the chance that a response hands an attacker a working conversation.

The header indicator the researchers flagged, “X-MS-Exchange-Organization-AuthAs: Anonymous,” may be useful for mail administrators reviewing logs or building detection rules around unauthenticated delivery paths.

Because the campaign was observed following US Eastern business hours, with weekday peaks and near-zero weekend traffic, the timing itself may give defenders a reference point for when to watch unauthenticated mail volumes most closely. That pattern suggests the attackers were timing activity to periods when office email traffic is normally high, which could make anomalous messages harder to notice.

Organizations that rely on Direct Send for printers, scanners or legacy applications should weigh whether the convenience of that feature is worth the risk described in the report, particularly if they have not already moved to a stricter DMARC policy. The KnowBe4 recommendations focus on closing or restricting the pathway and on giving DMARC the information it needs to reject unauthorized mail, which together could limit an attacker's ability to use a trusted internal-looking address.

Until Microsoft or another independent party corroborates the campaign, the report remains a single vendor's account of activity observed over a two-month period. Even so, the configuration and detection guidance it contains can be evaluated on its own merits by security teams looking to reduce the attack surface that Direct Send can create.