This phishing campaign spoofs internal messages – here’s what we know

• Misconfigured mail servers allow attackers to spoof domains and bypass SPF, DKIM, and DMARC checks.
• Phishing emails imitate internal messages using kits such as Tycoon2FA with HR or voicemail subject lines.
• Stolen credentials facilitate secondary business email compromise (BEC) attacks in large-scale untargeted campaigns.

Cybercriminals abuse misconfigurations mail servers send highly convincing phishing emails and trick victims into sharing login credentials and other secrets. This is according to Microsoft who in a recent report stated that the practice is not new, but has become more popular in the second half of 2025.

In the document, Microsoft explained that scammers are taking advantage of the way some companies route email and how they set up security checks. Typically, email systems use checks such as SPF, DKIM, and DMARC to confirm that the message actually came from the organization it claims to be from.