Ghost-Sender Flaw Exposes Exchange Online Users to Sender Spoofing Attacks

A newly disclosed “Ghost-Sender” flaw is exposing Microsoft Exchange Online environments to large-scale email spoofing attacks, allowing threat actors to bypass standard email authentication controls and deliver forged messages directly to users’ inboxes.

The issue, identified by security researchers Lucas Dodgson, Tobias Oberdörfer, and Robin Hilber, stems from misconfigurations in hybrid or cloud email deployments where organizations rely on external MX records alongside Exchange Online.

The vulnerability enables attackers to send emails impersonating virtually any sender, internal or external, and to bypass SPF, DKIM, and DMARC protections. In affected environments, spoofed messages are accepted and delivered without warnings, even when authentication checks explicitly fail.

Researchers demonstrated that Exchange Online does not adequately enforce these controls when emails are sent directly to its infrastructure, effectively allowing malicious messages to evade filtering layers.

dsGhost-Sender Flaw

The root cause lies in how Exchange Online handles inbound mail when organizations route email through third-party filtering services or external MX providers.

In such setups, attackers can bypass the designated email gateway and directly target the tenant’s Exchange Online endpoint (for example, *.mail.protection.outlook.com).

Because Exchange Online does not strictly reject unauthenticated messages in this scenario, it processes and delivers spoofed emails even when authentication fails.

A typical attack requires minimal effort and can be carried out with simple SMTP tools or scripts. Researchers illustrated this with a PowerShell command that can send spoofed emails from arbitrary domains.

These messages can impersonate trusted entities such as “billing@microsoft.com” or internal executives, enabling highly convincing phishing campaigns, business email compromise (BEC), and invoice fraud attacks.

In cases involving internal spoofing, Outlook may even resolve profile details such as display names and images, thereby increasing credibility.

The impact is significant, particularly for enterprises that assume SPF, DKIM, and DMARC enforcement guarantees protection against spoofing.

According to the researchers’ analysis from InfoGuard Labs, more than 20% of the tested Exchange Online domains in bug bounty programs were found to be vulnerable, and nearly half of the organizations using external MX configurations lacked appropriate mitigations.

Notably, Microsoft’s own security tools, including the Configuration Analyzer, do not currently flag this exposure, leaving many organizations unaware of the risk.

Further complicating detection, standard anti-phishing and anti-spam policies, such as “Honor DMARC”, do not apply when emails are sent directly to Exchange Online in these configurations.

Even enabling enhanced filtering or strict protection presets fails to block the attack in many cases. This creates a dangerous blind spot: organizations believe protections are active, yet attackers can still deliver malicious emails unchallenged.

Researchers also noted signs of active exploitation. Microsoft reportedly deployed and later rolled back partial mitigations targeting internal spoofing scenarios, suggesting ongoing challenges in fully addressing the issue without disrupting legitimate mail flow.

To mitigate the Ghost-Sender vulnerability, Microsoft recommends two primary approaches. The first involves configuring a “Partner Organization” connector with strict validation rules, ensuring only trusted IP addresses or certificates can send mail to the tenant. When properly configured with a wildcard domain scope, this method enforces rejection at the SMTP level for unauthorized senders.

The second approach uses transport (mail flow) rules to quarantine suspicious messages. Organizations can create rules that block or isolate emails lacking trusted source IPs or specific internal authentication headers. While this method allows visibility into blocked messages, it operates after initial acceptance, making it less strict than connector-based enforcement.

Additionally, turning off the “Direct Send” feature can help prevent internal spoofing. However, it does not fully address external impersonation risks. Security teams are also encouraged to validate their exposure using the publicly released testing tool at ghost-sender.com, which can simulate spoofing attempts and confirm whether mitigations are effective.

The Ghost-Sender flaw highlights a broader issue in cloud email security: misconfigurations at the intersection of third-party services and native platforms can silently undermine core protections. As organizations increasingly adopt hybrid and layered email architectures, ensuring correct configuration becomes as critical as deploying security controls themselves.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.