M365 phishing campaign clusters attacks in US workday
Cybercriminals abusing Microsoft 365’s Direct Send feature concentrated malicious email activity around US Eastern business hours, according to a new analysis of a large phishing campaign tracked during July and August. KnowBe4 Threat Lab said it identified tens of thousands of confirmed phishing messages sent through Direct Send, a legitimate Exchange Online delivery method intended for devices…
Microsoft 365’s Direct Send feature was exploited by cybercriminals in a July-August phishing campaign, according to a new KnowBe4 Threat Lab analysis. The attackers concentrated malicious email activity during US Eastern business hours, with volumes peaking around 2pm local time and being heaviest on weekdays. The campaign used familiar internal-sounding sender names like HR, admin, and no-reply to increase the chances of recipients treating the messages as regular business traffic.
Around 35% of the observed messages contained attachments, all of which were classified as threats. The sending infrastructure changed over the campaign period, indicating the operators were rotating cloud services, with Oracle Cloud being the largest contributor to the Direct Send traffic. Microsoft advises administrators to use Direct Send only when legacy devices or applications cannot support other sending methods and to implement email authentication controls such as SPF, DKIM, and DMARC.
Written by urgent.news from Arabian Post's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
