Receiving weird phishing emails from myself?

Question

Team members in my company have started receiving odd phishing emails claiming that an employee has a voicemail waiting for them. Attached is a file that says "Outlook item" (shown below) which usually pulls up a one page document with a malicious QR code. The weird part is I am unable to find the sender as it will usually seem like it was sent from the employee themself and there is no header data available. I am looking to find out where these emails are coming from and how I can block them.

Answer 1

It's a direct send exploit, see https://www.varonis.com/blog/direct-send-exploit

disabling direct send will resolve it.

Answer 2

Hello @MK

Thank you for posting your question in the Microsoft Q&A forum.    

According to your description, this likely is a spoofing attack, where threat actors forge the "From" address to make emails look like they’re sent internally. The lack of header data suggests: 

• The emails may be sent from external sources using forged headers. 
• Your organization might not have email authentication protocols like SPF, DKIM, and DMARC properly configured. 

You can follow these suggestions to enhance your organization's security: 

Check Email Authentication Setup (SPF, DKIM, DMARC) 

• Go to your domain registrar or DNS provider. 
• Verify that your domain has: 
  • SPF record: Should include Microsoft 365 (include:spf.protection.outlook.com) 
  • DKIM: Enabled in Microsoft 365 Admin Center under Exchange > DKIM 
  • DMARC: Add a DNS TXT record like: 
    • Name: _dmarc.yourdomain.com Value: v=DMARC1; p=quarantine; rua=mailto:******@yourdomain.com  

Analyze the Phishing Email 

• Open the email in Outlook Web or Desktop. 
• Click More actions (⋯) > View message details or View source. 
• Look for: 
  • Return-Path 
  • Received headers 
  • SPF/DKIM/DMARC results 

If headers are missing, the email may be spoofed or sent via compromised third-party services. 

Run a Message Trace 

To identify the true source and delivery path: 

• Go to the Microsoft 365 Defender portal. 
• Navigate to Email & Collaboration > Explorer or Message Trace. 
• Search for the suspicious email using: 
  • Sender address 
  • Subject line 
  • Date range 

Note: You need to be a Microsoft 365 admin to perform this action. If not, please contact your IT admin to know who has access to this portal. 

Block the Sender or Domain 

In the Microsoft 365 Security & Compliance Center: 

• Go to Policies & Rules > Threat Policies > Tenant Allow/Block List 
• Add the sender’s domain or IP to the Block list. 

Enable Anti-Phishing and Safe Attachments Policies 

In Microsoft Defender for Office 365: 

• Go to Policies > Anti-phishing 
• Enable impersonation protection for internal users 
• Enable Safe Attachments to scan and detonate suspicious files. 
• For your reference: Why do I need Microsoft Defender for Office 365? - Microsoft Defender for Office 365 | Microsoft Learn 

Educate and Alert Your Team 

Send a company-wide alert: 

• Warn about spoofed emails and malicious QR codes. 
• Advise not to open suspicious attachments or scan unknown QR codes. 
• Encourage reporting to IT/security. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Answer 3

It's happening since forever, I've seen it around 10 years ago for the first time.
Will this ever be fixed? Mail server does have the data to check if you really sent the email to yourself or not.