Metrofibre email systems compromised

[Ipwn 4]

Just received this

From (Envelope): [email protected]
From (Header): [email protected]
To: Undisclosed recipients:
Subject: REFERENCE LETTER
Sent: Tue, 17 Sep 2024 - 09:43:59

According to Mimecast:

Authentication-Results: relay.mimecast.com;
dkim=pass header.d=metrofibre365.onmicrosoft.com header.s=selector2-metrofibre365-onmicrosoft-com header.b=LDDTF4ZO;
arc=pass ("microsoft.com:s=arcselector10001:i=1");
dmarc=pass (policy=none) header.from=metrofibre.co.za;
spf=pass (relay.mimecast.com: domain of [email protected] designates 40.107.145.73 as permitted sender) smtp.mailfrom=[email protected]
Received: from CT2P275CU008.outbound.protection.outlook.com

 

[gregmcc]

What a poor setup. They also still have a p=none policy on DMARC so any spoofed mails will get delivered anyway.