Catch Phishing That Passes DMARC From Microsoft's Own Address

Since mid-October 2026, phishing has been arriving from Microsoft’s real notification addresses, quarantine@messaging.microsoft.com and microsoftoffice365@messaging.microsoft.com. Microsoft 365 uses these addresses for quarantine and encrypted-message notices. The lures pass SPF, DMARC and Microsoft’s own sender checks, so most mail apps show no warning. A strong DMARC policy at the receiving end will not stop them either. In a 30-day hunt across the organizations we monitor, these lures reached 27% of them between 13 and 21 October 2026.

One of the lures, from microsoftoffice365@messaging.microsoft.com. Sanitized.

What to do

1. Quarantine mail Microsoft didn’t sign. Microsoft’s genuine notices from messaging.microsoft.com are DKIM-signed by notification.microsoft.com. These lures are unsigned or signed by another tenant’s domain, so quarantine any that lack that signature. Match on the signing domain, not on DKIM passing, because a gateway in front of Exchange Online can break the genuine signature. Keep “Honor DMARC record policy” on in your anti-phishing policy, as Microsoft recommends: it still rejects plain spoofs of this address.

2. Flag the attribution header. X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp was on every lure we examined and on none of the genuine notices we compared. A sender can supply it, so treat it as a campaign signal alongside the DKIM check rather than proof on its own. Our Sublime detection rule, severity high:

   type.inbound
   // sent from the shared microsoft exchange online messaging domain
   and sender.email.domain.domain == "messaging.microsoft.com"
   // exchange online names the tenant it attributed the connection to
   and any(headers.hops,
           any(.fields,
               strings.ilike(.name,
                             "X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp"
               )
           )
   )

3. Block or quarantine HTML attachments. Some lures carried .htm files named like PDFs that redirect the browser to an outside site. Stop inbound .htm and .html attachments where your business allows it.

4. Use phishing-resistant MFA, such as passkeys. If someone entered their password, reset it, revoke their sessions, and check for new MFA methods, inbox rules and app consents.

5. Don’t block the domain. Microsoft’s real quarantine and encrypted-message notices use it.

For your users: a real Microsoft sender address doesn’t prove an email came from Microsoft. Check storage or account status by opening OneDrive or office.com directly, not through a link.

Why these messages pass

The messages are relayed through a Microsoft 365 tenant. Exchange Online accepts them even though they fail DMARC on the way in, then sends them on from Microsoft’s own servers with Microsoft’s address left in place. Every check after that sees what looks like genuine Microsoft mail.

The headers show each step:

At the first hop, action=oreject means Exchange Online saw Microsoft’s p=reject policy fail and did not reject the message. Microsoft documents that result when the relaying tenant has “Honor DMARC record policy” turned off, or an allow list overrides it. Why Exchange Online then neither rewrote the envelope nor used its relay pool is the question we’ve put to Microsoft.

This is also why DMARC cannot help the recipient. Your own DMARC record protects only mail that claims your domain, so it has no say over mail from messaging.microsoft.com. Honoring the sender’s policy doesn’t help either: Microsoft already publishes p=reject, and by the time these lures reach you they pass it. The only DMARC failure happened at the first hop, inside the tenant that relayed them.

In June 2026, ZeroBEC showed attackers sending phishing from this sender through a Microsoft 365 tenant. In their sample, Exchange Online rewrote the envelope sender (the Sender Rewriting Scheme, SRS) and the message failed DMARC (compauth=none reason=451). The messages we found were not rewritten, and they pass.

Appendix

Screenshots

All lures were sent as messaging.microsoft.com between 13 and 21 October 2026. Each is sanitized. The recipient is user@example.com, links are disabled and remote images are removed.

Each caption names the display name the lure used, the Microsoft address that sent it, and what its link or attachment does.

Indicators

Values are defanged (hxxp, [.]). Each block’s copy button copies the whole list, one value per line.

390b51b2f763025c7b2c749315ca6d8d9205df3221e4c7f6c171f0e9f6359309
c85f9e50acc41239123f58c1c7c1a1d2693b1dcb4af883f322b68749b7e880b1
23b609d28344d6c544e8ac8912d22606238cea15b368ac81ee1468d996a287f8
ccd8d266b742a6fd23f6029efc99a6e90a06ec8b8e06d331d90cf3528f66cef8
5b677266e5cf07f5743a3e625b2be6adc50eec2c7f628bea445fda08e82c3048

In the same order, the file names were Medical-PDF.PDF_<digits>.htm (the first three), Report___PDF.PDF_____<digits>.htm and Report-PDF.PDF_<digits>.pdf.

hxxps[://]managements-center.audiogears[.]asia
hxxps[://]openid-connect.aftermiracleplus[.]asia
hxxps[://]hrtwsupport.ezsports.com[.]tw
hxxps[://]ftpmanager.convencioniberoamerica[.]com
hxxps[://]account.romisingh[.]com

The first four take a query string; account.romisingh[.]com uses a path form:

/?<random>=1&id%25<mailbox>&d31ac157c4ed4638c=2&sucess%25<domain>&<random>=3&INVIT=<digits>
/r/a9f3k/INVIT=<digits>/sucess%25<domain>%25?id%25<mailbox>%25&suite_ID=gid=msg-f:<digits>

hxxps[://]edo.undo[.]it
hxxps[://]ioxhns.mastbusiness[.]com
hxxps[://]pjswax.mastbusiness[.]com
hxxps[://]dtvaol.mastbusiness[.]com
hxxps[://]gigghauxbkxld.mastbusiness[.]com
hxxps[://]ctrkklclick[.]com

edo.undo[.]it served the Mayo Clinic and Adobe Elements lures, gigghauxbkxld the GP Schools lure, and the other mastbusiness[.]com hosts and ctrkklclick[.]com the M-ADMIN lure. Each takes a path of /<token>, except ctrkklclick[.]com, which uses /l/<id>; it is a lookalike of Klaviyo’s click tracker ctrk.klclick.com, registered 2024-09-24.

Security Alert: Cloud Account Frozen
Warning: Inactive Files Directory Will Be Deleted
Re: Inactive files directory scheduled for deletion
Urgent: Important: Account Temporarily Suspended
Update: Account has been Suspended .
the mailbox is full
RE: Your Recent Laboratory and Vitamin Test Results
RE: Adobe FREE Acrobat Pro + AI Assistant Plus
Your Settlement Report ID:545222928 for 16 Oct 2026
Re: No - 000000

OneDrive.com
OneDrive Cloud Alert
OneDrive Services Alert
M-ADMIN
Mayo Clinic
Adobe Elements
GP Schools
SchoolGroup.com

The first three were sent from microsoftoffice365@, the rest from quarantine@. “SchoolGroup.com” has no screenshot.

hxxp[://]65.bacan4d[.]skin
hxxp[://]energybankinc.lgdusallc[.]net

Both tracking URLs end ?q=o&s=<token>.

Do not block

These legitimate services appear in the lures:

• messaging.microsoft.com, including both sender addresses above: Microsoft’s own notification domain. Match on display name or DKIM instead.
• data.digital.adobe.com and landing.adobe.com: Adobe click tracking and image hosting.
• cdn.klaviyomail.com: Klaviyo image hosting.
• ctrk.klclick.com: Klaviyo’s shared click tracker. The “M-ADMIN” lure rides a Klaviyo account, so key on its company path VtpRdw, not on the host.