Sophisticated quarantine@messaging.microsoft.com spoof email passes all spam checks.

[u/darksoul189]

Came across this in the wild today as a sysadmin, spoofed quarantine@messaging.microsoft.com email suggesting a forwarding group had a 98% full mailbox. Passed all SPF, DKIM, Dmarc checks because it came from a genuine Microsoft tenant. In the headers its given away by the actual tenant which was sirackoleji.onmicrosoft.com

Submitted to Microsoft for analysis and confirmed as a highly sophisticated spoof worth being vigilant.

[u/derfmcdoogal]

Been seeing similar fake Barracuda ESS quarantine notifications the last few weeks. Barracuda warned multiple organizations that may have whitelisted the ess email address.

[u/AP_ILS]

I had a user report an email from [microsoftoffice365@messaging.microsoft.com](mailto:microsoftoffice365@messaging.microsoft.com) that passed all checks too.

[u/InsolentJaguar]

Always remember...they can spoof the header, but the envelope is much harder.

[u/antiduh → u/InsolentJaguar]

but the envelope is much harder.

You need PHP for that :)

[u/goatsinhats]

So Microsoft with its trillion+ inputs a day monitoring all things cyber security didn’t pick up someone was sending spam from a 365 account?

[u/derfmcdoogal → u/goatsinhats]

They could train copilot to assist in spam prevention... Or, make money off it. Decisions, decisions...

[u/WackoMcGoose → u/derfmcdoogal]

Google makes bank off of malware authors putting zero-click drive-by downloaders into the AdSense pot, making it so you can get pwned on a fully-patched browser and OS, just by visiting a completely mundane website (statistically, most often YouTube since that's what gets targeted the most). Why wouldn't Microsoft want some of that bag for themselves?

[u/Frothyleet → u/goatsinhats]

I know you're being facetious but Microsoft does not really put a lot of effort into outbound spam, except that they maintain a "low reputation" IP block that they will move tenants into if they consistently trip spam detection.

[u/goatsinhats → u/Frothyleet]

Wish I was, doing some certs and Microsoft advertises defender as taking in 165 trillion signals a day

[u/MalletNGrease → u/goatsinhats]

Spamhaus notices regularly

[u/Grumpy-Troglodyte]

i've had those the last couple days too, i didn't dig into them too deep but something in them is getting caught by a filter i have set to catch some phrases, i'm assuming it's the mailbox full one i did..we get so many variants of that one a week i made a rule years ago to stop them from getting to users and it worked on this address too

[u/yeshelloisthisyou]

Same issue over here, with very realistic messages about Onedrive reaching it’s limit. Quite insane that this is not being flagged by MS.  

[u/Particular-Score-195]

I've been seeing this too over the past week, luckily the body is about medical exam results a majority of the time so no one is falling for it.

[u/Shellfishy]

We saw this too, likewise the 365 one. We also found hidden text in the quarantine one, talking about a voicemail and some zoom stuff.