Hackers Bypass Microsoft 365 RejectDirectSend With Empty SMTP Sender to Spoof Internal Emails

Threat actors can bypass Microsoft 365’s RejectDirectSend protection by using an empty SMTP envelope sender, allowing phishing messages to appear as if they were sent by trusted internal users, according to ReliaQuest.

RejectDirectSend is an Exchange Online control designed to stop unauthenticated Direct Send emails that claim to originate from an organization’s own Microsoft 365 domain.

Direct Send is commonly used by printers, scanners, applications, and other devices to send messages to users within the same tenant without needing sign-in credentials.

However, ReliaQuest found that the control checks the domain in the SMTP envelope sender, also called the MAIL FROM address.

When attackers send a message using an empty envelope sender, represented as MAIL FROM:<>, there is no domain available for RejectDirectSend to evaluate.

The visible From address can still display a trusted internal identity, such as “IT Support” or an executive email address.

This creates a phishing risk because recipients may trust the sender identity shown in their email client, even though the message originated externally and without authentication.

Empty Sender Bypasses RejectDirectSend

In controlled testing, ReliaQuest sent two unauthenticated messages directly to a Microsoft 365 tenant with RejectDirectSend enabled. Both messages used the same internal-looking From header, recipient, sending host, and SMTP session settings.

The only meaningful difference was the SMTP envelope sender.

Microsoft 365 rejected the baseline message because the envelope sender used the tenant’s accepted domain. The empty-envelope message, however, was accepted for delivery because RejectDirectSend had no sender domain to inspect.

The bypass does not automatically guarantee inbox delivery. In ReliaQuest’s test, Microsoft 365 classified the email as anonymous and unauthenticated, assigning it a Spam Confidence Level of 9 and routing it to the Junk Email folder. SPF and DKIM checks did not pass, while DMARC failed.

Still, acceptance into the tenant’s mail flow is significant. Mailbox placement depends on later anti-spam and phishing controls, message content, source infrastructure, and tenant-specific exceptions.

A poorly configured allow rule could override those protections and allow the message to reach the recipient’s inbox.

ReliaQuest said it observed multiple phishing cases using empty SMTP envelope senders between September 2025 and August 2026. The activity targeted executives, managers, finance staff, procurement teams, and customer-facing employees.

Attackers commonly used document-sharing notices, payment requests, remittance details, procurement invitations, and voicemail or fax notifications as lures.

Some campaigns used SVG attachments disguised as voicemail recordings, potentially pushing victims toward malicious links or credential-harvesting pages.

In one investigated case, Microsoft 365 identified a message as high-confidence phishing and found that sender authentication had failed.

Despite this, the message reached the inbox because the spoofed executive address was configured as an allowed sender.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN

The post Hackers Bypass Microsoft 365 RejectDirectSend With Empty SMTP Sender to Spoof Internal Emails appeared first on Cyber Security News.