Microsoft 365 direct send has been abused for phishing.

Hackers have begun to use Microsoft 365 to avoid email security protocols. Researchers have found that this tactic is being increasingly used due to its easy implementation. Users are advised to enable multifactor authentication and static IP addresses.

Read more:

https://www.securityweek.com/microsoft-365-direct-send-abused-for-phishing/