# EchoSpoofing: Phishing Campaign Abusing Proofpoint Email Protection Relay to Send Millions of Authenticated Spoofed Emails

> Beginning January 2024, an unidentified spammer abused a permissive Proofpoint outbound-relay configuration for Office 365 (any M365 tenant accepted) to send ~3 million spoofed brand emails per day (peak 14 million) that carried valid SPF and DKIM. Guardio Labs reported it to Proofpoint in May 2024; Proofpoint added tenant-level filtering via X-OriginatorOrg and explicit tenant approval.

- **Published:** 2026-10-16T23:46:12Z
- **Last reviewed:** 2026-10-16T23:46:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3788
- **ID:** TL-2026-3788
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

EchoSpoofing is a large-scale phishing and spam campaign documented by Guardio Labs (published 2024-07-29, IOCs updated 2024-07-27) that exploited a misconfiguration, not a CVE, in how Proofpoint Email Protection handles Office 365 outbound routing. When a Proofpoint customer selected 'Office 365' during relay setup, Proofpoint authenticated inbound connections purely by Microsoft IP ranges (SPF include:spf.protection.outlook.com alongside the customer's pphosted.com include) without binding the relay to the customer's own tenant. Any Microsoft 365 account could therefore submit mail to the customer's Proofpoint relay host (for example mx0a-00278502.pphosted.com) with an arbitrary spoofed From domain.

The attacker workflow documented by Guardio: (1) build a spoofed message on an attacker-controlled SMTP server (PowerMTA, a cracked copy) running on rented VPS hosts at OVHcloud and Centrilogic, with sending domains registered at Namecheap; (2) route it through a rogue or compromised Office 365 tenant using an Exchange 'via Frontend Transport' connector that blindly relays mail without altering headers; (3) deliver it to the target brand's Proofpoint relay; (4) Proofpoint treated the message as legitimate outbound traffic and applied the brand's real DKIM signature, while the Office 365 source IP satisfied the brand's SPF record. Messages passed SPF, DKIM and DMARC and were delivered to the inbox at Gmail and similar providers. Proofpoint described it as 'echoing' the spoofed email back as fully genuine.

The observed lures impersonated brands such as Disney, IBM, Nike, Best Buy, Coca-Cola, Fox News and Novartis (31 spoofed domains listed). A representative lure was a spoofed Disney+ account notification with a customer quiz that led to a fake purchase page with an obscured recurring-charge clause, aimed at harvesting credit-card and financial data. Sender addresses followed the pattern admin_support.XXXX@disney.com with a random suffix. Infrastructure preparation started around November 2023, mass sending began in January 2024 (average ~3M/day, peak 14M/day in early June 2024). An exposed PowerMTA dashboard showed v5.0r3 with 11 virtual MTAs (pmta-vmta1 to pmta-vmta11) configured for batches of 2.8 million emails and a license string linked to a publicly advertised cracked-PowerMTA service.

Proofpoint became aware in late March 2024 and responded within hours of Guardio's May 2024 contact. Remediation: customer notification, tenant-based filtering using the Microsoft X-OriginatorOrg header (Exchange strips spoofed copies), a new Office 365 onboarding screen requiring explicit tenant approval, and anti-spoof guidance. Proofpoint stated that any email infrastructure offering this routing feature can be abused. In early June the actors burned assets as mitigations spread. Guardio noted the abused Office 365 accounts stayed active for more than seven months despite alerts to Microsoft. Proofpoint reported no customer data exposure. Attribution: a single unidentified spam actor with no known group affiliation; a cracked-PowerMTA reseller using the handle 'Rony' appears in the license string, but Guardio found no direct evidence linking that person to the campaign.

## MITRE ATT&CK

- T1583.001 Acquire Infrastructure: Domains
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1585.003 Establish Accounts: Cloud Accounts
- T1586.003 Compromise Accounts: Cloud Accounts
- T1588.002 Obtain Capabilities: Tool
- T1566.002 Phishing: Spearphishing Link
- T1078.004 Valid Accounts: Cloud Accounts
- T1684.002 Email Spoofing
- T1684.001 Impersonation
- T1036 Masquerading
- T1090 Proxy
- T1204.001 User Execution: Malicious Link

## Sources

- [EchoSpoofing — A Massive Phishing Campaign Exploiting Proofpoint's Email Protection to Dispatch Millions of Perfectly Spoofed Emails (Guardio Labs)](https://guard.io/labs/echospoofing-a-massive-phishing-campaign-exploiting-proofpoints-email-protection-to-dispatch)
- [Proofpoint settings exploited to send millions of phishing emails daily (BleepingComputer)](https://www.bleepingcomputer.com/news/security/proofpoint-settings-exploited-to-send-millions-of-phishing-emails-daily/)
- [Phishing Campaign Exploited Proofpoint Email Protections for Spoofing (SecurityWeek)](https://www.securityweek.com/phishing-campaign-exploited-proofpoint-email-protections-for-spoofing/)
- [Proofpoint Email Routing Flaw Exploited to Send Millions of Spoofed Phishing Emails (The Hacker News)](https://thehackernews.com/2024/07/proofpoint-email-routing-flaw-exploited.html)
- [Proofpoint Platform Exploited to Send Millions of Spoofed Phishing Emails (Security Boulevard)](https://securityboulevard.com/2024/07/proofpoint-platform-exploited-to-send-millions-of-spoofed-phishing-emails)
- [Massive EchoSpoofing Phishing Campaign Exploits Proofpoint's Email Security Platform (emailexpert)](https://emailexpert.com/massive-echospoofing-phishing-campaign-exploits-proofpoints-email-security-platform/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3788