This phishing campaign spoofs internal messages - here's what we know

A fish hook is lying across a computer keyboard, representing a phishing attack on a computer system.

• Misconfigured email servers let attackers spoof domains and bypass SPF, DKIM, and DMARC checks
• Phishing emails mimic internal messages using kits like Tycoon2FA with HR or voicemail themes
• Stolen credentials fuel secondary Business Email Compromise (BEC) attacks across broad, non-targeted campaigns

Cybercriminals are abusing misconfigurations in email servers to send highly convincing phishing emails and trick victims into sharing login credentials and other secrets. This is according to Microsoft who, in a recent report, said the practice isn’t new, but it did grow more popular in the second half of 2025.