KnowBe4 Threat Lab has published new research uncovering 29,785 confirmed phishing emails abusing Microsoft 365’s Direct Send functionality across July and August 2026.
Direct Send is a legitimate Microsoft 365 feature designed to allow devices such as printers and scanners, as well as legacy applications, to send emails without a dedicated account.
However, researchers found attackers exploiting the same delivery route to send emails that appear to originate from trusted internal addresses, such as HR, accounting or admin, without first compromising an employee account or obtaining their credentials.
The research also reveals a distinctly human pattern to the campaigns.
Attacks roughly followed US Eastern business hours, with volumes peaking just before noon, dipping and then reaching their highest point at around 2pm.
According to the company, this pattern was observed across Monday and Tuesday, while weekend volumes dropped dramatically compared with weekdays.
Rather than relying on obviously suspicious external senders, attackers are using Direct Send to exploit the inherent trust employees place in communications that appear to come from inside their own organisation.
Findings
KnowBe4 revealed that the findings included:
- 29,785 confirmed Direct Send spoofs were identified across July and August
- 4,023 used a reply-to address pointing to a different domain, routing employee responses directly to the attacker
- Around 35% of emails carried attachments, virtually all of which were classified as threats
- One email reached 900 recipients in a single send. Common impersonated sender names included HR, admin, no-reply, accounting and meeting
- Lures included fake document requests, internal voicemail alerts, invoices and payment approvals and fake OneDrive file shares
Direct Send attacks
The company also said that the research found that Direct Send attacks can bypass the organisation’s normal email security gateway by connecting directly to its Exchange Online MX endpoint.
While authentication checks may detect that something is wrong, organisations using a DMARC monitoring policy can still allow the message to be delivered.
Additionally, KnowBe4 Threat Lab identified a useful signal defenders can hunt for: Direct Send emails carry the Exchange header “X-MS-Exchange-Organization-AuthAs: Anonymous.”
When this appears on a message claiming to originate from an internal address, it indicates the email arrived through an unauthenticated delivery path.