Microsoft has introduced a new security feature in its Defender for Office 365 suite to counter email bombing attacks. Called “Mail Bombing Detection,” the feature is designed
to automatically detect and quarantine high-volume email flooding campaigns that aim to clog user inboxes or hide important messages.
This capability will roll out globally from late June through July 2025. It requires no setup by security teams, offering out-of-the-box protection against this growing threat.
What Is Email Bombing?
Email bombing is a type of cyberattack where attackers flood a user's inbox with thousands of messages in a short period. The goal is to disrupt communications or hide critical messages, such as security alerts or fraud notifications, under a barrage of junk emails.
How Microsoft’s Solution Works
Microsoft's detection engine uses machine learning to distinguish malicious bombing activity from legitimate bulk emails like newsletters. It evaluates message volume, sender reputation, and content similarities to identify suspicious behavior.
Once detected, these messages are automatically moved to users' Junk folders. The system respects Safe Sender lists to avoid flagging trusted sources.
Visibility for Security Teams
Security teams can track email bombing incidents through:
- Threat Explorer (ThreatExplorer.Action == "MailBombing")
- Email Entity View
- Email Summary Panel
- Advanced Hunting queries using KQL
This integration ensures smooth inclusion in existing monitoring tools and reporting processes.
Recommendations for Organizations
As the rollout approaches, Microsoft advises organizations to:
- Update internal documentation to include this new feature.
- Review Junk folder handling policies.
- Inform security teams of dashboard changes and new detection alerts.
For organizations with compliance obligations, note that this feature affects email classification, routing, and audit logging for messages sent to Junk folders.
The Mail Bombing Detection feature adds a critical defense layer to Microsoft Defender for Office 365, helping organizations better protect their email systems from increasingly common and disruptive inbox flooding attacks.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
