Direct Send carried 29,785 spoofed internal emails past the mail gateway in two months

The bypass is a routing fact. Direct Send delivers to the tenant's own Exchange Online MX endpoint, so mail sent that way never transits the security gateway in front of the mailboxes ^[6]. Rules written at that gateway never see the message. There is nothing in the sign-in logs either, because the sender never authenticates as anyone: the feature exists so printers, scanners and legacy applications can send mail without a dedicated account ^[3][5].

That leaves domain authentication as the only control in the path, and a monitoring-only posture does not hold. "While authentication checks may detect that something is wrong, organizations using a domain-based message authentication, reporting and conformance (DMARC) monitoring policy can still allow the message to be delivered," KnowBe4's report said ^[7]. Its remedy is p = reject in place of p = none ^[15].

Attachments rode about 10,400 of the messages, which is 35% of 29,785, and KnowBe4 classified virtually all of them as threats ^[8][1]. Another 4,023 carried a reply-to address on a different domain, 13.5% of the total, routing employee responses to the operator ^[10][2]. One send addressed 900 recipients ^[11].

Across a 62-day window, 29,785 messages average roughly 480 a day ^[3]. KnowBe4 did not see them spread evenly: activity clustered Monday to Tuesday inside US Eastern business hours, peaking just before noon, dipping, then reaching its daily high near 2pm EST ^[12]. The researchers called this a "distinctly human pattern" ^[13]. It tells you when the sending was scheduled, not where the operators sit, and the report names no group ^[18].

For hunting, the marker is the header X-MS-Exchange-Organization-AuthAs: Anonymous, which indicates an unauthenticated delivery path ^[14]. The rest of KnowBe4's list is inventory work: restrict senders through Exchange Online connectors to approved IP addresses, sign outbound mail with DKIM so DMARC has something to check, and close the Direct Send pathway where it is not required ^[16][17]. That last condition carries the effort. Somebody has to establish which multifunction printer, scanner or old line-of-business application still relies on the pathway, because closing it without that list drops mail the business notices faster than the security team does.

The lures were ordinary: fake document requests, internal voicemail alerts, invoices and payment approvals, and fake OneDrive file shares ^[9]. Nothing in that set requires novelty, because the sender line does the work. A message that arrives addressed as HR or accounting, inside the recipient's working hours, from an internal-looking address, is asking to be opened ^[4].