Email security

The attackers exploit Microsoft 365's Direct Send feature, a legitimate tool for devices and legacy applications to send emails without a dedicated account.

Invisible Unicode tag characters often used for AI prompt injection have appeared in high-volume phishing attacks.

The technique bypasses RejectDirectSend by SMTP envelope sender blank.

The false positive is attributed to an inaccurate security classification within the Defender for Office 365 Safe Links feature.

This feature aims to shield users' primary email addresses from websites, while still ensuring that messages from these services are forwarded.

The attackers employed a broad, non-targeted approach, sending messages in waves and largely avoiding weekends.

Block rate is not a proxy for detection coverage against these threats

The "beehive" attacks, attributed to the Russian group Laundry Bear (also known as TA488 and Void Blizzard), exploit a flaw in Zimbra webmail, allowing attackers to compromise systems simply by viewing a crafted email.