Microsoft Warns of a Surge in Phishing Attacks Exploiting Email Routing Gaps

In early January 2026, Microsoft issued a major security alert: phishing attacks exploiting complex email routing paths and misconfigured spoof‑protection settings are rapidly increasing, allowing threat actors to send emails that appear to originate from inside an organisation.

According to Microsoft, attackers are taking advantage of “complex routing scenarios, such as MX records pointing to on‑premises servers or third‑party services, and improperly configured DMARC/SPF protections.” These gaps make it possible to spoof internal domains and deliver phishing emails that closely resemble genuine internal communications, significantly increasing the likelihood of credential theft, financial fraud, and business email compromise (BEC).

Microsoft notes, “This technique is not new, but its visibility and use have increased substantially since May 2025, with attackers launching broad, opportunistic campaigns across multiple industries.”

What Microsoft Is Seeing: Key Attack Patterns

Microsoft’s warning highlights several emerging trends that show attackers improving both their techniques and success rates:

• Highly convincing internal‑style phishing emails. Messages imitate trusted internal communications such as shared files, HR updates, password resets, and voicemail alerts.
• Weak or misconfigured SPF, DKIM and DMARC settings. Authentication gaps allow spoofed internal domains to pass validation checks that should normally block them.
• Unexpected or complex routing paths in email headers. These reveal authentication failures or bypasses where messages have not travelled through the expected Microsoft 365 route.

Microsoft’s Recommendations to Reduce Exposure

To protect against these increasingly effective phishing attacks, Microsoft puts emphasis on strengthening core email authentication and routing controls:

1. Enforce strict Domain-based Message Authentication, Reporting and Conformance (DMARC) and Sender Policy Framework (SPF) policies
   Ensure misconfigured or permissive settings aren’t allowing spoofed emails to be accepted. Rejecting unauthenticated messages dramatically reduces successful spoofing attempts.

2. Review and harden mail flow rules
   Verify that every connector, rule, and trusted service is properly configured so that all inbound mail, particularly through non‑Microsoft routes, undergoes full authentication checks.

3. Simplify mail routing wherever possible
   When MX records point directly to Microsoft 365, organisations benefit from Microsoft’s native spoof‑protection capabilities. This reduces the likelihood of routing gaps and simplifies the overall mail flow, making suspicious patterns easier to detect.

Business Impact: Why These Attacks Matter

These attacks aren’t just a technical weakness, they create real operational, financial, and security risks. Microsoft’s findings highlight several consequences organisations are now facing:

• Greater risk of credential compromise. Employees trust internal‑looking messages, making them far more likely to click malicious links or share credentials. Once attackers gain access, they can move laterally, steal data, and maintain long‑term access.
• Higher likelihood of Business Email Compromise. Internal spoofing creates ideal conditions for BEC, one of the most financially damaging cybercrimes. Attackers can impersonate executives, divert payments, and manipulate vendor interactions.
• Financial fraud and disruption. With access or convincing spoofed emails, attackers can initiate illegitimate invoice payments, alter financial workflows, or access sensitive systems leading to downtime, costly investigations, and reputational harm.
• Widespread exposure due to opportunistic targeting. These campaigns are not highly targeted; any organisation with routing or authentication misconfigurations can be hit.
• Reduced trust in internal communication. Successful impersonation undermines confidence in internal emails, leading to slower communication, productivity challenges, and heightened staff anxiety.

How Diamond IT Can Help

At Diamond IT, we help organisations strengthen their Microsoft 365 security posture and reduce the risk of these evolving phishing threats. Our team supports customers by:

• Reviewing Microsoft 365 email and security configurations to identify vulnerabilities.
• Improving email authentication posture including SPF, DKIM and DMARC.
• Optimising mail flow design and routing for clarity, simplicity, and security.
• Delivering staff awareness training to help users recognise modern internal‑looking phishing scams.

Our goal is to ensure customers have a secure and resilient Microsoft 365 environment, reducing risk, strengthening trust in internal communication, and helping them stay ahead of evolving phishing techniques.

Contact us today about how we can help your organisation, on 1300 307 907, email us at enquiries@diamondit.com.au or fill out the form below.