Internal Phishing and Spoofing Emails are Increasing in 2026: What's Ahead
In the summer of last year, we noticed something peculiar. Cybercriminals had found a new trick and were flying under the radar of even the most advanced email security systems. In June of 2025, a phishing campaign emerged that abused Microsoft 365’s Direct Send feature where emails appear to come from inside the organization, even from the company's own address. As of 2026, this has evolved rapidly including Business Email Compromise (BEC) and abusing legitimate cloud platforms. As we approach 2027, attackers will focus less on breaking into systems and more on exploiting the trust you have in the security your companies is supposedly (and hopefully are) using.
Featured in this article:
- Microsoft 365 Direct Send Impacts
- How This Impacts Your Business
- What Centre's Doing
- Learn More from Centre's Cybersecurity Workshop Videos
What's Happening with Microsoft 365 Direct Send?
Threat actors leverage the Direct Send feature (designed for internal delivery) to push spoofed emails without authenticating. This essentially means they’re exploiting Direct Send to impersonate internal users even without access to your Microsoft 365 tenant.
These messages often:
- Bypass standard filters (yes, even advanced third party email filtering services)
- Look like voicemail notifications or internal updates
- Contain malicious QR codes or PDF attachments
- These messages often pass SPF and DMARC checks with soft-fail or none at all—because the domain’s policies aren’t configured to enforce rejection (‘p=reject’)
They're using Microsoft infrastructure (*.mail.protection.outlook.com — Learn more here) to give these emails that oh-so-trustworthy look. Here’s the kicker—no credentials or tenant access needed.
Here's a 2025 breakdown from Microsoft Exchange Team Blog. This is still an accurate description in 2026 with this update from the Exchange team.
How It Impacts Your Business
Direct Send is a trust exploit which is the type of evolving cybersecurity threat that underscores the need for Secure Managed Services. If your SPF/DMARC policies are outdated or your users aren't prepared to spot spoofed internal emails, you're at risk.
What's Changed with Email Spoofing scams since 2025?
When Direct Send abuse started hitting the cybersecurity news space, businesses had limited controls at their disposal.
Today, Microsoft has the ability to enable Reject Direct Send, so you don't rely on Direct Send to block this type of traffic. They also expanded their visibility and reporting abilities so you better understand how Direct Send in used within your environments. So now the issue has moved from discovering new threats to making sure you have evaluated and secured your environments against those threats.
In essence, we're living in a proactive 2026 world as opposed to the reactive once in 2025.
Email Authentication is your next step
Companies across all industries are implementing SPF, DKIM, and DMARC records, but sill struggle with enforcement. DMARC research (SENDMARC, EasyDMARC, and DMARCguard) found a significant gap between teams that have published DMARC records and those who have fully enforced DMARC policies at p=reject (configuration that proactively prevents domain spoofing).
Here's a breakdown of what's trending in 2026:
- DMARC adoption is growing across global domains
- Businesses stay in monitoring mode (p=none)
- Enforcement is significantly lower than adoption
- Attackers continue exploiting domains that don't have fully implemented email authentication controls
As things like phishing and QR code scams focus on impersonation (not to mention BEC for SMBs), strong authentication policies will be a cybersecurity requirement rather than you recommended best practice.
What Businesses Should Expect from phishing and spoofing in 2027
The next generation of attacks won't be limited to email. Microsoft threat intelligence teams have noted increased social engineering activity across their platforms including Teams. the goal is always exploiting the apps your think you can trust. Be diligent.
In 2027, expect attackers to continue abusing trusted platforms like:
- Microsoft 365
- Teams
- SharePoint and OneDrive
- Electronic document signing platforms
- Cloud collaboration tools
Attackers go after legitimate services because people naturally trust familiar brands and platforms.
The question needs to move from: "Can we block malicious emails?" to "Can we verify the identity of the sender of this email?"
Your Next Steps
If you're unsure whether your environment is hardened against this latest exploit, now’s the time to act:
- Request a free email security assessment
- Review your SPF/DMARC/DKIM policies
- Schedule a training refresh
- For Centre customers, ask your vCIO about enabling “Reject Direct Send”
What Centre Is Doing to Help
Our Security Operations (SOC) team actively monitors for emerging phishing tactics and collaborates with Microsoft, our security partners, and internal teams to create awareness and stay ahead of threats like this one. We stay ahead of email-based threats with a multi-layered security strategy. Here's how we're helping customers defend against these sophisticated spoofing tactics:
Email Authentication Hardening
We review and configure your domain’s records with aggressive protections—pushing DMARC policies to p=reject where appropriate.
M365 and Exchange Online Controls
We help enable Microsoft's new “Reject Direct Send” feature, blocking these spoofing attempts before they hit user inboxes.
Security Awareness Training
Through KnowBe4 security awareness training and onboing awareness initiatives, we make sure your employees can spot suspicious emails—especially internal-looking ones or QR-code attacks.
Security Operations Monitoring (SecOps)
If issues persist, escalation to our in-house Security Operations Center ensures rapid analysis and targeted remediation if spoofing persists for further investigation, analysis, and resolution.
