Threat reportPhishingTL-2026-3788
EchoSpoofing: Phishing Campaign Abusing Proofpoint Email Protection Relay to Send Millions of Authenticated Spoofed Emails
EchoSpoofing (TL-2026-3788), also tracked as EchoSpoofing, is a high-severity phishing campaign, first published 2026-10-16. It has no confirmed attribution, affects Proofpoint Proofpoint Email Protection (outbound relay, Office 365, maps to 12 MITRE ATT&CK techniques (T1036, T1078.004, T1090), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 12MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-3788
- Threat ID
- TL-2026-3788
- Also known as
- EchoSpoofing
- Severity
- HIGH
- Status
- PATCHED
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- retail, media-entertainment, technology, consumer-goods, health, energy, food-distribution, consumers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in EchoSpoofing
Malware and tooling: PowerMTA v5.0r3
How EchoSpoofing works
Beginning January 2024, an unidentified spammer abused a permissive Proofpoint outbound-relay configuration for Office 365 (any M365 tenant accepted) to send ~3 million spoofed brand emails per day (peak 14 million) that carried valid SPF and DKIM. Guardio Labs reported it to Proofpoint in May 2024; Proofpoint added tenant-level filtering via X-OriginatorOrg and explicit tenant approval.
EchoSpoofing is a large-scale phishing and spam campaign documented by Guardio Labs (published 2024-07-29, IOCs updated 2024-07-27) that exploited a misconfiguration, not a CVE, in how Proofpoint Email Protection handles Office 365 outbound routing. When a Proofpoint customer selected 'Office 365' during relay setup, Proofpoint authenticated inbound connections purely by Microsoft IP ranges (SPF include:spf.protection.outlook.com alongside the customer's pphosted.com include) without binding the relay to the customer's own tenant. Any Microsoft 365 account could therefore submit mail to the customer's Proofpoint relay host (for example mx0a-00278502.pphosted.com) with an arbitrary spoofed From domain.
The attacker workflow documented by Guardio: (1) build a spoofed message on an attacker-controlled SMTP server (PowerMTA, a cracked copy) running on rented VPS hosts at OVHcloud and Centrilogic, with sending domains registered at Namecheap; (2) route it through a rogue or compromised Office 365 tenant using an Exchange 'via Frontend Transport' connector that blindly relays mail without altering headers; (3) deliver it to the target brand's Proofpoint relay; (4) Proofpoint treated the message as legitimate outbound traffic and applied the brand's real DKIM signature, while the Office 365 source IP satisfied the brand's SPF record. Messages passed SPF, DKIM and DMARC and were delivered to the inbox at Gmail and similar providers. Proofpoint described it as 'echoing' the spoofed email back as fully genuine.
The observed lures impersonated brands such as Disney, IBM, Nike, Best Buy, Coca-Cola, Fox News and Novartis (31 spoofed domains listed). A representative lure was a spoofed Disney+ account notification with a customer quiz that led to a fake purchase page with an obscured recurring-charge clause, aimed at harvesting credit-card and financial data. Sender addresses followed the pattern admin_support.XXXX@disney.com with a random suffix. Infrastructure preparation started around November 2023, mass sending began in January 2024 (average ~3M/day, peak 14M/day in early June 2024). An exposed PowerMTA dashboard showed v5.0r3 with 11 virtual MTAs (pmta-vmta1 to pmta-vmta11) configured for batches of 2.8 million emails and a license string linked to a publicly advertised cracked-PowerMTA service.
Proofpoint became aware in late March 2024 and responded within hours of Guardio's May 2024 contact. Remediation: customer notification, tenant-based filtering using the Microsoft X-OriginatorOrg header (Exchange strips spoofed copies), a new Office 365 onboarding screen requiring explicit tenant approval, and anti-spoof guidance. Proofpoint stated that any email infrastructure offering this routing feature can be abused. In early June the actors burned assets as mitigations spread. Guardio noted the abused Office 365 accounts stayed active for more than seven months despite alerts to Microsoft. Proofpoint reported no customer data exposure. Attribution: a single unidentified spam actor with no known group affiliation; a cracked-PowerMTA reseller using the handle 'Rony' appears in the license string, but Guardio found no direct evidence linking that person to the campaign.
MITRE ATT&CK techniques used in TL-2026-3788
Defense Evasion
T1036 Masquerading; T1684.001 Impersonation; T1684.002 Email Spoofing
Initial Access
T1078.004 Valid Accounts: Cloud Accounts; T1566.002 Phishing: Spearphishing Link
Command and Control
Execution
T1204.001 User Execution: Malicious Link
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1583.003 Acquire Infrastructure: Virtual Private Server; T1585.003 Establish Accounts: Cloud Accounts; T1586.003 Compromise Accounts: Cloud Accounts; T1588.002 Obtain Capabilities: Tool
Affected products and versions in EchoSpoofing
- Proofpoint — Proofpoint Email Protection (outbound relay, Office 365 connector)
Vulnerable versions: Customer configurations using the Office 365 option without tenant restriction (pre-mitigation, observed January-June 2024)
Fixed in: Service-side X-OriginatorOrg tenant filtering and explicit tenant approval onboarding (mid-2024) - Microsoft — Exchange Online / Microsoft 365 tenants (abused as relay source)
Vulnerable versions: Rogue or compromised tenants with blind-relay connectors
Remediation for EchoSpoofing
Patches
- Proofpoint applied a service-side fix: X-OriginatorOrg tenant filtering and an updated Office 365 onboarding screen with explicit tenant approval
Immediate actions
- Proofpoint customers: in the Email Protection Office 365 connector settings, approve only your own Microsoft 365 tenant(s) and review any unrecognized tenants
- Review outbound relay and connector configuration for any 'accept any Office 365' or IP-only authentication
- Monitor outbound/DKIM-signed mail for messages with an X-OriginatorOrg tenant that is not yours
- Block or investigate listed SMTP IPs and sending domains at the mail gateway for inbound filtering
Workarounds
- Where tenant approval is not configured, restrict the connector to specific tenant identifiers rather than the generic Office 365 option
Longer-term hardening
- Enforce DMARC with p=quarantine or p=reject and review SPF includes for overly broad third-party ranges
- Apply Proofpoint anti-spoof policy guidance and alert on spoofed-brand mail passing authentication
- Email providers should default to tenant-level isolation for relay and require extra verification for relay setup
- VPS providers should restrict bulk outbound SMTP from new instances
Weaknesses (CWE) in EchoSpoofing
Timeline of EchoSpoofing
- Attacker infrastructure setup begins roughly two months before mass sending (month-level date per Guardio)
- Mass spoofed-email campaign begins via Proofpoint relay abuse, averaging ~3 million emails per day (month-level date)
- Proofpoint becomes aware of the abuse in late March 2024 (approximate date)
- Guardio Labs identifies the campaign and notifies Proofpoint, which responds within hours (month-level date)
- Volume peaks at about 14 million emails per day in early June; actors begin burning assets as mitigations roll out
- Proofpoint rolls out X-OriginatorOrg tenant filtering, explicit Office 365 tenant approval onboarding, and customer notifications (approximate mid-2024 date; exact release date not stated in sources)
- Guardio updates its report with IOCs (O365 tenants, SMTP IPs, SMTP domains, spoofed domains)
- Guardio Labs publishes the EchoSpoofing research; BleepingComputer, SecurityWeek and The Hacker News report on it
Sources cited for EchoSpoofing
- EchoSpoofing — A Massive Phishing Campaign Exploiting Proofpoint's Email Protection to Dispatch Millions of Perfectly Spoofed Emails (Guardio Labs)
- Proofpoint settings exploited to send millions of phishing emails daily (BleepingComputer)
- Phishing Campaign Exploited Proofpoint Email Protections for Spoofing (SecurityWeek)
- Proofpoint Email Routing Flaw Exploited to Send Millions of Spoofed Phishing Emails (The Hacker News)
- Proofpoint Platform Exploited to Send Millions of Spoofed Phishing Emails (Security Boulevard)
- Massive EchoSpoofing Phishing Campaign Exploits Proofpoint's Email Security Platform (emailexpert)
Detection coverage for TL-2026-3788
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3788 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.