29,785 — that is the number of confirmed phishing emails KnowBe4’s Threat Lab team observed abusing Microsoft 365’s Direct Send feature across July and August 2026.
KnowBe4 Threat Lab findings
Researchers at KnowBe4 tracked 29,785 confirmed phishing messages sent over a two‑month period and described a “distinctly human pattern” in their delivery. The activity clustered on Monday and Tuesday during US Eastern business hours, with volumes rising just before noon, dipping briefly, then reaching a second and higher peak at about 2pm EST. The report, published on September 10, also found that roughly 35% of the flagged emails carried attachments — “virtually all of which” were classified as threats — and that 4,023 malicious emails used a reply‑to address on a different domain so that responses routed directly to the attacker. In one observed send, an attacker reached 900 recipients with a single message.
Microsoft 365 Direct Send feature and how it was abused
Direct Send is a legitimate Microsoft 365 feature intended to allow devices such as printers and scanners, and legacy applications, to send email without a dedicated account. KnowBe4’s analysis shows attackers exploited that functionality to craft messages that appear to originate from trusted internal addresses — HR, accounting or admin — while avoiding the need to compromise an employee account or obtain credentials. Because the technique connects directly to an organization’s Exchange Online MX endpoint, it can bypass the organization’s normal email security gateway.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleIndicators and defensive steps recommended by KnowBe4
KnowBe4 offered concrete signs and mitigations organizations can use to detect and block this abuse. One diagnostic indicator is the Exchange header X‑MS‑Exchange‑Organization‑AuthAs: Anonymous — a marker suggesting the message arrived through an unauthenticated delivery path. The report also advised organizations to enforce a strict DMARC policy, changing it from p=none to p=reject, to block spoofed messages that claim to come from the organization’s domain. Additional recommendations include restricting legitimate senders through Exchange Online connectors so only approved IP addresses may relay mail, closing the Direct Send pathway if it is not required, and enabling DomainKeys Identified Mail (DKIM) signing to give DMARC the cryptographic information it needs to detect and reject unauthorized outbound mail.
Observed lures and attachment types
KnowBe4 cataloged the social‑engineering themes used in the campaign. Attackers delivered fake document requests, internal voicemail alerts, invoices and payment approvals, and counterfeit OneDrive file‑share notices. Approximately 35% of the messages carried attachments, and the report states that “virtually all” of those attachments were classified as threats. The use of authentic internal‑sounding senders and reply‑to routing to attacker domains amplified the campaign’s ability to elicit responses or clicks.
What this means for security teams, enterprise leaders, and end users
- Security teams: Look for the X‑MS‑Exchange‑Organization‑AuthAs: Anonymous header in mail logs, audit Exchange Online connectors for unrestricted relays, and consider tightening DMARC to p=reject and enabling DKIM signing as the report recommends.
- Enterprise leaders and procurement: Evaluate whether Direct Send is required for legacy devices and applications; where it is not, close the pathway or restrict permitted IP addresses on connectors to reduce an easy relay for attackers.
- End users: Be skeptical of internal‑looking messages that request documents, invoices, voicemail retrieval, or OneDrive access and verify unusual requests through an out‑of‑band channel before opening attachments or replying.
KnowBe4’s findings tie a high volume of phishing to a specific Microsoft 365 configuration and to working‑hour timing that resembles legitimate workplace behavior. The report’s advice — search for an anonymous authentication header, tighten DMARC to p=reject, lock down Exchange Online connectors, close unnecessary Direct Send pathways and enable DKIM — gives defenders a short list of technical controls to implement now. Whether organizations adopt all those steps will determine how effectively attackers can keep using Direct Send to impersonate trusted internal senders.
