Direct Send is a legitimate Microsoft 365 feature that allows devices, applications, and third-party services to send emails directly to users’ mailboxes without requiring authentication or account compromise. The NJCCIC received a report in which threat actors exploited the legitimate Direct Send feature to target an organization and send phishing emails. The attack process begins with threat actors identifying valid organizational domains and recipient email addresses. The threat actors then create spoofed emails that are delivered directly through Microsoft 365’s infrastructure. In this campaign, the phishing email contains a malicious document link for a disbursement agreement for review that, if clicked, directs the target to a Microsoft phishing page to capture account credentials.
Recommendations
- Exercise caution with unexpected or unsolicited communications, including those from known senders or legitimate services or platforms.
- Confirm requests from senders using contact information obtained from verified, official sources before taking action, such as clicking links or opening attachments.
- Navigate directly to legitimate websites and verify before submitting account credentials, providing personal or financial information, or downloading files.
- Keep systems and browsers up to date.
- If sensitive information was entered, change passwords for compromised accounts, notify financial institutions of fraudulent transactions, monitor for unauthorized activity, and review the Identity Theft and Compromised PII NJCCIC Informational Report for additional recommendations and resources.
- Review the Proofpoint blog post for additional recommendations for Microsoft 365 customers.