Reported by 3 outlets

Timeline

1. original reporting

   Hackers Bypass Microsoft 365 RejectDirectSend With Empty SMTP Sender to Spoof Internal Emails

   cyberpress.org · 39d ago · September 4th, 2026

   Threat actors can bypass Microsoft 365’s RejectDirectSend protection by using an empty SMTP envelope sender, allowing phishing messages to appear as if they were sent by trusted internal users, according to ReliaQuest. RejectDirectSend is an Exchange Online control designed to stop unauthenticated Direct Send emails that claim to originate from an organization’s own Microsoft 365 domain . Direct Send is commonly used by printers, scanners, applications, and other devices to send messages to users within the same tenant without needing sign-in credentials. However, ReliaQuest found that the control checks the domain in the SMTP envelope sender, also called the MAIL FROM address. When attackers send a message using an empty envelope sender, represented as MAIL FROM:<> , there is no domain available for RejectDirectSend to evaluate. The visible From address can still display a trusted internal identity, such as “IT Support” or an executive email address. This creates a phishing risk because recipients may trust the sender identity shown in their email client, even though the message originated externally and without authentication. Empty Sender Bypasses RejectDirectSend In controlled testing, ReliaQuest sent two unauthenticated messages directly to a Microsoft 365 tenant with RejectDirectSend enabled. Both messages used the same internal-looking From header, recipient, sending host, and SMTP session settings. The only meaningful difference was the SMTP envelope sender. Test SMTP

2. update from gbhackers.com

   Microsoft 365 Direct Send Bypass Lets Attackers Spoof Internal Users Without Credentials

   gbhackers.com · 39d ago · September 4th, 2026

   A Microsoft 365 email security-control bypass that lets attackers submit unauthenticated messages posing as internal users by leaving one SMTP field blank. The technique targets Exchange Online’s RejectDirectSend setting and does not represent a vulnerability in Microsoft software or in ReliaQuest systems; instead, it exposes a limitation in how the control evaluates Direct Send traffic. […] The post Microsoft 365 Direct Send Bypass Lets Attackers Spoof Internal Users Without Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from securityonline.info

   A Microsoft 365 RejectDirectSend bypass lets attackers spoof internal emails. Learn how this RejectDirectSend bypass works and how to protec

   securityonline.info · 34d ago · September 9th, 2026

   Learn how this RejectDirectSend bypass works and how to protec

   via Mastodon https://securityonline.info/rejectdirectsend-bypass/?utm_source=mastodon&utm_medium=jetpack_social