Manufacturing phishing is rising as Direct Send abuse persists

At a glance

What this is: This is an analysis of why manufacturing is absorbing more phishing, vendor impersonation, and invoice-fraud activity, with Microsoft 365 Direct Send abuse standing out as a recurring delivery method.

Why it matters: It matters because manufacturing mail flows combine high-value payment activity, broad supplier trust, and lean operations, so identity and mail-authentication assumptions can be exploited even when messages appear technically legitimate.

By the numbers:

• Manufacturing accounts for 27.7% of incidents in IBM's 2026 X-Force Threat Intelligence Index.
• Business email compromise cost victims $3.04 billion in reported losses in 2025, per the FBI's IC3 annual report cited by IRONSCALES.
• Verizon's 2026 Data Breach Investigations Report ties third parties to 61% of manufacturing breaches and the human element to 56%, as cited by IRONSCALES.

Context

Manufacturing email environments are unusually exposed because payment traffic is frequent, suppliers change often, and business pressure rewards fast responses. That combination weakens the practical value of message authenticity alone, because a mail stream can be technically valid and still be operationally hostile.

The identity problem is not limited to human users. Trusted suppliers, shared inboxes, unauthenticated sending paths, and workload-like mail sources all create opportunities for abuse when lifecycle controls and sender validation are too permissive. In this article, Microsoft 365 Direct Send becomes the clearest example of how a legitimate transport mechanism can be repurposed for fraud.

The article's starting position is typical of manufacturing, not exceptional. The sector's broad trust surface and lean IT staffing make it a recurring target for phishing, vendor impersonation, and invoice diversion.

Key questions

Q: What breaks when Direct Send is left open in Microsoft 365?

A: When Direct Send remains open, unauthenticated mail can enter the tenant looking like internal or trusted partner traffic. That breaks the assumption that sender identity has been verified before a message reaches users, so phishing, invoice fraud, and spoofed business requests can bypass normal trust cues even when authentication on the mail itself is technically clean.

Q: Why do high-volume phishing campaigns that steal credentials often lead to payment fraud and invoice abuse?

A: They create immediate access to real conversations, vendor relationships, and financial context. Once an attacker enters a mailbox, they can search for payment details, invoices, and merchant references, then impersonate legitimate contacts in ongoing threads. That context lets them craft convincing follow-on messages that feel routine, making fraud harder to spot than a fresh phishing email.

Q: What are the signs that vendor impersonation is succeeding even when authentication passes?

A: Look for payment-change requests, urgent invoice revisions, or banking updates from senders that are technically authenticated but inconsistent with normal supplier behaviour. A passing SPF, DKIM, or DMARC result does not prove legitimacy. The clearest warning sign is a request that matches a business process but not the sender's usual pattern.

Q: How should organisations govern supplier mail when it becomes part of the access path?

A: Treat supplier mail as a governed access path, not as ordinary correspondence. That means defining who can request changes, how those requests are verified, and what happens when a supplier account is compromised. The control boundary has to extend beyond the inbox into business approval and third-party identity governance.

Technical breakdown

Why credential harvesting works in manufacturing mail flows

Credential harvesting succeeds when attackers can mimic the software, document-sharing, and scheduling systems staff already expect to hear from. In manufacturing, that expectation is amplified by supplier coordination and line-of-business urgency, so pixel-accurate lures and redirect chains often survive the first trust decision. The technical issue is not only the landing page but the trust pathway that gets the user there, including legitimate infrastructure used to hide the final collection point. Authentication controls can still say a message is valid while the content remains malicious.

Practical implication: inspect the trust path, not just the final URL, and treat familiar business workflows as high-risk phishing themes.

How Microsoft 365 Direct Send bypasses normal sender controls

Direct Send lets devices and applications send mail into a tenant without authenticating, which means an attacker can abuse the feature to send messages that appear to originate from the organisation's own domain. Because the mail may contain no malware, no obvious malicious URL, and no compromised user session, classic gateway signatures are weak signals here. Detection shifts to behaviour analysis, especially sender patterns that do not match the historical role of a printer, scanner, or application account.

Practical implication: disable or tightly restrict Direct Send where possible, and monitor for unauthenticated mail from roles that should never behave like people.

Why SPF, DKIM, and DMARC are necessary but not sufficient

SPF, DKIM, and DMARC validate message path and domain control, not sender intent. That matters in vendor impersonation and vendor email compromise, where attackers may send from real compromised mailboxes or from legitimate email service providers. In those cases, authentication can pass while the request itself is fraudulent, which is why inbox controls must consider relationship context, payment-change language, and unusual sender behaviour. Mail security that stops at authentication leaves a gap between technical legitimacy and business legitimacy.

Practical implication: pair authentication enforcement with behavioural and business-context detection for payment and banking-change requests.

Threat narrative

Attacker objective: The attacker wants to turn trusted manufacturing communication channels into a payment-diversion or credential-theft path that produces direct financial gain.

1. Entry begins with phishing delivered through familiar manufacturing business themes such as invoices, e-signature requests, and supplier updates, often using legitimate infrastructure to look ordinary.
2. Credential harvesting or vendor impersonation follows when the victim is pushed to enter credentials or trust a spoofed banking-change request from a compromised or lookalike sender.
3. Impact arrives as payment diversion, account compromise, or fraudulent access to business mail flows that support invoicing and procurement decisions.

Breaches seen in the wild

• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Manufacturing phishing persists because business authenticity and technical authenticity are not the same control. The article shows that SPF, DKIM, and DMARC can all pass while the request is still fraudulent, which is the key governance failure in supplier-heavy environments. The control gap is not message validation alone but validation of whether the sender and request belong in the business process at all. Practitioners should treat payment workflows as identity and authorization problems, not just email-security problems.

Microsoft 365 Direct Send abuse exposes a trust gap between infrastructure convenience and sender accountability. A feature built for devices and applications becomes risky when it allows unauthenticated mail to enter a tenant with the appearance of internal legitimacy. That is a non-human identity governance problem in practice: a sending path with no meaningful lifecycle, ownership, or behavioural constraint. The practitioner lesson is to govern unauthenticated sender paths as privileged business channels, not as harmless plumbing.

Vendor email compromise is a supply-chain identity problem before it is a phishing problem. The article's emphasis on compromised supplier accounts shows that manufacturers are often inheriting trust from entities they do not control. This is where identity governance extends beyond the enterprise boundary, because a supplier's mailbox can become the authentication layer for fraudulent change requests. Security teams should recognise third-party communication as an access path that needs policy, monitoring, and offboarding assumptions.

Invoice fraud thrives where operational speed outruns verification. Manufacturing teams face real pressure to keep production and payments moving, which makes abbreviated review cycles predictable for attackers. The point is not that humans fail, but that the process is designed to accept urgency as evidence. Practitioners should rebuild approval steps so urgent payment changes are the exception, not the default operating mode.

Direct Send hardening is a named concept worth carrying into broader mail governance: unauthenticated sender path exposure. The article makes clear that the risk comes from unauthenticated traffic entering trusted mail flows without a meaningful identity event to review. That concept applies wherever devices, applications, or service accounts can emit messages that are treated as organisationally trusted. The right response is to govern the sender path itself as part of access control and lifecycle management.

What this signals

Unauthenticated sender-path exposure is the core control gap behind Direct Send abuse. When a tenant accepts mail from devices or applications without a meaningful identity event, attackers can borrow the tenant's own trust surface to move fraudulent mail into the inbox. That shifts the security question from message filtering to sender governance.

Manufacturing programmes should expect phishing themes to keep following payment and supplier workflows because those processes are where trust is concentrated. The practical response is to combine mail controls with approval redesign, especially where banking changes or urgent invoice updates can trigger financial loss.

Supplier compromise turns third-party identity into a first-class risk for accounts payable and procurement. Teams that do not model supplier mail as part of their access surface will keep seeing technically valid messages that are operationally hostile.

For practitioners

• Disable unauthenticated Direct Send where feasible Turn on RejectDirectSend and verify which devices or applications actually depend on the feature before leaving it enabled. If a business unit insists on keeping it, restrict the path to tightly controlled cases and treat it as an exception with monitoring.
• Enforce DMARC on your own and supplier domains Move internal domains to enforcement and push key suppliers toward the same posture so spoofed or lookalike domains lose value. Pair that with review of domains that routinely appear in invoice, banking-change, and purchase-order traffic.
• Monitor behaviour for authenticated but suspicious mail Build detections for mail that passes SPF, DKIM, and DMARC yet arrives with abnormal sender behaviour, unusual volume, or a role that should not be generating human-like requests. This is especially relevant for Direct Send and compromised vendor mailbox abuse.
• Tighten payment-change verification Require a second channel for banking-change or wire-instruction updates and make the approval step independent of the email thread. Fraud teams and accounts payable should treat supplier changes as high-risk identity events, not routine correspondence.

Key takeaways

• Manufacturing email defence fails when teams rely on technical message validity alone, because authenticated mail can still carry fraudulent intent.
• The article links manufacturing exposure to a mix of supplier trust, high-value payments, and Direct Send abuse, which makes behaviour-based detection essential.
• The most effective controls are to close unauthenticated sender paths, enforce domain protections, and separate payment verification from the email thread.

Key terms

• Vendor Email Compromise: Vendor email compromise is a form of impersonation that targets supplier, contractor, or partner relationships. Attackers exploit routine vendor communication patterns to request payment changes, invoice redirection, or other sensitive actions, so identity and process verification must extend beyond internal users.
• Direct Send: Direct Send is a Microsoft email delivery method that can allow messages to be routed in a way that looks internal or trusted to some controls. Security teams need to understand that trusted routing does not automatically mean trusted content, especially when adversaries are abusing the path.
• Invoice Fraud: Invoice fraud is a business email abuse pattern where attackers redirect payments, alter supplier details, or request exceptions using convincing impersonation. The technical weakness is not only message delivery, but the absence of independent validation before financial action is approved.
• Behavioural email detection: A detection approach that looks for patterns in sender behaviour, message timing, language change, and downstream user interaction rather than relying only on signatures. It is designed to catch attacks that mutate quickly. For identity programmes, its value is in finding the moment an email becomes an access risk.

Deepen your knowledge

NHI Mgmt Group's NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners build the controls that keep non-human access accountable.