Microsoft 365’s ‘Direct Send’ feature exploited for phishing, allowing attackers to impersonate internal users and bypass security measures, posing significant risks.