Phishing actors spoofing domains by exploiting complex routing and misconfigurations

Phishing actors are abusing complex email routing setups and poorly configured spoofing protections to impersonate organizations’ domains and send phishing emails that appear to originate from within the organization. This technique has been used to distribute a wide range of phishing messages linked to phishing-as-a-service (PhaaS) platforms such as Tycoon2FA. Common lures include fake voicemails, shared documents, HR communications, password reset or expiration notices, and similar themes designed to steal credentials.

While this attack method is not new, its use has become more widespread and visible since May 2025. Microsoft has observed that these campaigns are largely opportunistic rather than targeted, with phishing emails sent to organizations across multiple industries and sectors. In some cases, the same vector has also been used to carry out financial fraud. Although these campaigns resemble other credential-phishing efforts in many ways, they are distinguished by their reliance on complex routing paths and misconfigured spoofing defenses. Notably, this technique does not affect organizations whose Microsoft Exchange MX records point to Office 365, as those tenants are protected by built-in spoofing detection.

Because these phishing emails appear to be sent internally, they may be particularly convincing. If credentials are compromised, attackers can carry out data theft, business email compromise (BEC) attacks, or financial fraud, potentially resulting in significant remediation efforts or monetary losses. While Microsoft blocks most of these attempts, organizations can further reduce their risk by correctly configuring spoofing protections and third-party connectors to prevent such messages from reaching user inboxes.

Attackers are seen exploiting these routing scenarios and shares insights from observed attacks. It includes concrete examples, technical analysis of phishing emails, spoofing configurations, and email headers to help identify this attack vector.