BleepingComputer reports that hackers have become aware of Direct Send, a relatively unknown feature in Microsoft 365 that’s primarily intended for use by on-premises printers and scanners that need to send emails as if they were sent from the organization’s domain.
According to security firm Varonis, hackers are using the Direct Send feature to send malicious emails that appear to come from a known sender. The emails contain a link to a fake Microsoft form, and when the recipient enters their login details, those details are intercepted.
Since May 2025, around 70 companies and organizations have been affected by the phishing campaign, mainly in the US.
According to Microsoft, Direct Send is a secure feature but it requires users to configure the right settings and properly lock down their smart host, which doesn’t always happen. “We recommend Direct Send only for advanced customers willing to take on the responsibilities of email server admins,” explains Microsoft.
To minimize the security risks involved, concerned users are encouraged to turn on the new “Reject Direct Send” setting in the Exchange Admin Center, which was introduced in April 2025.
Further reading: You need to know about these common phishing scams that too many people fall for