Phishing campaign leverages Microsoft 365 Direct Send feature

The attackers exploit Microsoft 365's Direct Send feature, a legitimate tool for devices and legacy applications to send emails without a dedicated account.