One Empty Field: The Email Security Bypass Letting Attackers Impersonate Your Executives

Organizations rely on Microsoft 365's RejectDirectSend control to block internal email spoofing—but a structural gap lets attackers walk right past it. With nothing more than a basic Python script and an empty envelope sender, threat actors are impersonating executives, IT support, and finance teams to launch Business Email Compromise, payment fraud, and follow-on account takeover.

Join hosts Alexandra Moore and John Dilgen as they discuss:

• How an empty email header field bypasses RejectDirectSend and lands phishing in executive inboxes
• How help desk impersonation combined with spoofed internal email creates a dangerous new pretext
• Which controls—IP-restricted connectors, automated containment, and out-of-band verification—actually close the gap

 Two questions your organization should be asking right now:

• If someone attempted a Direct Send from an unauthorized IP into your tenant tomorrow, would it be rejected?
• When was the last time you tested whether your employees follow out-of-band verification procedures under pressure?

Resources: https://linktr.ee/ReliaQuestShadowTalk

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Alexandra Moore: Manager of Threat Intelligence at ReliaQuest, where she leads intelligence analysis and customer dissemination to help organizations understand and respond to emerging cyber threats. Prior to this, she established and scaled monitoring across Russian-language cybercriminal platforms at Digital Shadows, building collection and analytical coverage to support digital risk protection capabilities.