Warning: This Message Originated from Outside of Your Organization

The talk argues that users have become desensitized to external-sender warning banners, and that well-known SaaS platforms can be abused to deliver phishing email. It walks through the usual phishing setup: buying an aged domain, getting it categorized by web filters, publishing SPF, DKIM and DMARC records, and warming the domain up so it does not look suspicious. The speaker notes that such domains often burn quickly, which forces attackers to repeat the work.

The middle of the talk shows two examples. In the first, a free project-management trial sends invitation emails with attacker-controlled body text that pass authentication checks, although some invites were filtered to spam. In the second, an API management invitation template in Azure sends mail from a Microsoft-signed sender with customised display details. A serverless function proxy is then shown acting as a redirector, so traffic appears to end at a Microsoft-owned IP address with a valid certificate. Safe-link scanners can be sidestepped by serving them benign content.

The closing discussion covers defences: requiring domain-ownership verification before SaaS senders can use a company's domain, pointing users to internal portals instead of external links, preparing staff for expected vendor emails, blocking services the organization does not use, and adding content analysis and defence-in-depth layers. The main takeaway is that passing email authentication does not establish trust, and organizations should update their risk models for mail sent through trusted services.