Researchers find a hole in Microsoft’s anti-spoofing fix
Key insight: A message sent with an empty return address gets accepted by Microsoft 365 tenants that have Reject Direct Send switched on, while an otherwise identical message gets turned away. What’s at stake: The technique requires no stolen password, no compromised account and no answered multi-factor prompt, so defenses built around protecting logins do […]
Researchers find a hole in Microsoft’s anti-spoofing fix Read More »
