Microsoft Anti-Spoofing Fix Found Flawed by Researchers

Microsoft's anti-spoofing fix has been found to have a hole in it by researchers at ReliaQuest. The technique, which requires no stolen password or compromised account, allows attackers to send external emails that appear as internal messages.

The method works by leaving the return address blank on an email sent to a company with Reject Direct Send enabled. This setting blocks external emails that disguise themselves as internal, but the loophole discovered by ReliaQuest makes it possible for attackers to bypass this protection.

The technique has been used in business email compromise schemes, where employees are tricked into wiring money or handing over credentials. The finding comes after the FBI described a phishing kit in May that hijacked Microsoft 365 mailboxes used by bank staff.