Threats I hunted
EchoSpoofing
An exploit in Proofpoint email protection routing that let any Office 365 tenant dispatch spoofed emails signed authentically as Disney, Nike, and IBM.
- 3M - 14M / day
- spoofed emails dispatched
- Fortune 100
- brands spoofed with valid SPF & DKIM
- Microsoft & Broadcom
- shipped protections named after it
An overly permissive relay configuration allowed any Office 365 tenant to route outbound emails through Proofpoint’s infrastructure. The emails emerged with valid cryptographic SPF and DKIM signatures belonging to Fortune 100 enterprises.
We caught the campaign in the wild, reproduced the flaw end-to-end, and coordinated with Proofpoint and Microsoft to deploy global mitigations. Both Microsoft and Broadcom subsequently published threat intel and defenses named after EchoSpoofing.
In the press
BleepingComputerProofpoint settings exploited to send millions of phishing emails daily The Hacker NewsProofpoint Email Routing Flaw Exploited to Send Millions of Spoofed Messages Microsoft DefenderSecure architecture design – How Defender for Office 365 protects against EchoSpoofing Broadcom Threat IntelAnti-EchoSpoofing Protection in Email Security.cloud SC MediaWidespread email spoofing facilitated by Proofpoint email routing flaw Geektimeפתחתם מייל מדיסני פלוס? חוקרים ישראליים גילו שיכול להיות שאלו האקרים מתחזים TechRadarProofpoint email filter flaw exploited to send out millions of phishing messages Cyber InsiderProofpoint’s Services Abused to Dispatch Millions of Phishing Emails ITProA flaw in Proofpoint’s anti-phishing platform allowed a hacker to send millions of spam emails The RegisterProofpoint phishing palaver plagues millions with ‘perfectly spoofed’ emails from IBM, Nike, Disney, others Techzine GlobalTsunami of spoof emails due to abuse of Proofpoint service
- SecurityWeekPhishing Campaign Exploited Proofpoint Email Protections for Spoofing
- Dark ReadingDisney, Nike, IBM Signatures Anchor 3M Fake Emails a Day
- Infosecurity MagazineMillions of Spoofed Emails Bypass Defenses in 'EchoSpoofing' Campaign
- Risky BusinessRisky Biz News: EchoSpoofing Enterprise Mail Relay Abuse
- HalonEchoSpoofing explained: here's how you can protect your email software
- VirtruEchoSpoofing: Lessons Learned from Proofpoint Email Phishing Exploit
- PowerDMARCEchoSpoofing: Email Routing Exploit Explained
- Channel InsiderEchoSpoofing: Phishing Wave Crashes Through Proofpoint
Read the research
Behind the Connect Button