Microsoft Warns Misconfigured Email Routing Can Enable Internal Domain Phishing

Threat actors are exploiting routing vulnerabilities and misconfigured email spoof protections to impersonate organizational domains, enabling them to send convincing internal-looking phishing emails. This technique has been used to distribute a broad range of phishing messages, including those associated with phishing-as-a-service (PhaaS) platforms like Tycoon 2FA, highlighting a sophisticated evolution in email-based cyber threats.