ThreatResearch
Ghost-Sender
Universal Email Spoofing against Exchange Online
https://labs.infoguard.ch/posts/ghost-sender
Using Exchange Online (or on-premises exchange in hybrid mode) in combination with an external MX record, such as a third-party email server or spam protection solution, can allow the spoofing of emails from any sender to any recipient in the target tenant.
Hardening Whitepaper
Know Your Blind Spots: Better Visibility Through EDR Policy Hardening 2026.
EDR tools identify, detect, and respond to anomalous behavior. They assist blue teams, incident response operations, and threat hunting. However, an EDR is only as effective as the events it can detect. Alerts and actions depend on the tool's detections, which in turn depend on visibility within the environment.
— CISO as a Service —
Strategic Cyber Defense & GRC
Resilient Through Knowledge
2026.06.21
https://www.linkedin.com/posts/alirezaghahrood_edr-policy-hardening-2026-ugcPost-7474517183457525760-rWsE
Forwarded fromCISO as a Service
InfoGuard Labs
Ghost-Sender - Universal Email Spoofing against Exchange Online - InfoGuard Labs
An analysis of a widely available Exchange Online misconfiguration allowing attackers to spoof internal and external senders.
June 21, 2026 1.4K 1
