·6 min read
Microsoft's Tycoon2FA Findings: How a Routing Misconfiguration Let Attackers Spoof Real Domains
Microsoft disclosed that Tycoon2FA phishing campaigns are exploiting a specific mail-routing misconfiguration to spoof organizations' own domains — bypassing SPF and DKIM checks that should have caught them. Here's exactly how it works and how to close it.
DMARCSPFPhishingIncident analysis