Office Printers Exploited in New Phishing Campaign

In the ever-escalating arms race between cybercriminals and digital defenders, the vectors of attack grow ever more inventive, often exploiting the most innocuous corners of our connected lives.

We’ve seen sophisticated phishing campaigns, the weaponization of smartwatches to breach air-gapped networks, and even clever bypasses for Windows secure boot. Yet, the latest revelation serves as a stark reminder that the most potent threats can emerge from the seemingly mundane: your office printer. Learn about the cybersecurity risks office printers pose.

A new, ongoing hacking campaign is leveraging these unassuming workhorses, transforming them into conduits for highly deceptive cyberattacks against Windows systems.

The ingenuity lies not in a zero-day exploit, but in the abuse of a poorly understood, yet surprisingly permissive, Microsoft 365 feature known as “Direct Send.” For more information, visit Microsoft’s guide on Direct Send.

This feature, designed for convenience, allows devices like printers and scanners to dispatch emails without any form of authentication. The question that immediately springs to mind is, of course, what could possibly go wrong with such an open-ended capability? As it turns out, quite a lot.

The Varonis Managed Data Detection and Response Forensics team has unearthed the full scope of this insidious threat. Their investigation confirms an active campaign that has already targeted at least 70 organizations, with a significant majority based in the United States.

The attackers are not compromising user accounts in the traditional sense; instead, they are harnessing the Direct Send function to forge internal emails, effectively spoofing legitimate users within an organization.

Imagine an email appearing to come from your finance department’s printer, or the scanner down the hall, instructing you to click a malicious link. The inherent trust placed in internal communications, even those from office equipment, makes these phishing attempts exceptionally dangerous. Understand more about phishing attacks on organizations.

Tom Barnea, a forensics specialist at Varonis, articulated the core problem with chilling clarity: “Threat actors are abusing the feature to spoof internal users and deliver phishing emails without ever needing to compromise an account.”

The malicious messages, originating from what appears to be a trusted internal source—an on-premises device like a printer—are therefore “subject to less scrutiny compared to standard inbound email.”

This bypass of typical email security filters, which are often configured to flag external or suspicious-looking communications, is what gives this campaign its potent edge.

The Varonis team’s findings suggest the campaign kicked off in May, maintaining a consistent level of activity over the past two months, underscoring its persistent and evolving nature.

This revelation casts a harsh light on the delicate balance between convenience and security in enterprise software.

Features like Direct Send, while perhaps offering a streamlined experience for specific use cases, can inadvertently create gaping security holes when their implications are not fully understood or properly managed.

Microsoft, for its part, has weighed in, acknowledging that most Microsoft 365 and Windows customers have no real need for the Direct Send feature.

In a promising, if somewhat belated, move, the tech giant stated it is actively working on an option to disable it by default to enhance customer protection. Yet, their concluding remark, recommending Direct Send “only for advanced customers willing to take on the responsibilities of email server admins,” feels like a subtle shifting of the burden, placing the onus on users to navigate complex security configurations for a feature that arguably should have been more secure by default.

For organizations grappling with this newly identified threat, Varonis has outlined several critical mitigation steps. Proactive defense is paramount.

First, enabling “Reject Direct Send” in the Exchange Admin Center is a foundational move. Beyond that, implementing a strict DMARC (Domain-based Message Authentication, Reporting & Conformance) policy can help validate email senders, making spoofing harder.

Organizations should also configure their systems to flag or quarantine any unauthenticated internal emails for review, adding an essential layer of human scrutiny. Furthermore, enforcing “SPF hardfail” within Exchange Online Protection and deploying robust Anti-Spoofing policies are vital technical safeguards that can significantly reduce the efficacy of such attacks.

The printer hack serves as a potent reminder that the cybersecurity landscape is a fluid battleground, where the next vulnerability might reside in the most overlooked corners of your network. It underscores the perpetual need for vigilance, not just against sophisticated external threats, but also against the subtle misconfigurations and overlooked features within your own digital ecosystem.

As long as convenience occasionally trumps security in software design, and as long as human trust remains a primary target, the ingenuity of threat actors will continue to find new ways to turn everyday office equipment into formidable weapons.

The lesson is clear: in the digital age, nothing, not even the humble printer, can be assumed to be entirely benign.