Microsoft 365 Mailbox Rule Abuse: The Hidden Account Compromise Risk Small Businesses Miss

When a Microsoft 365 account is compromised, many small businesses focus on the obvious steps: reset the password, require MFA, check recent sign-ins, and warn the user.

Those steps matter, but they are not enough.

Attackers often make quiet changes inside the mailbox after they get access. One of the most common is creating malicious inbox rules or forwarding settings. These rules can hide security alerts, move invoices out of sight, forward sensitive conversations to an external address, mark messages as read, delete replies, or help the attacker watch a business conversation until the right moment to commit fraud.

That makes mailbox rule abuse a practical business risk, not just a technical cleanup item.

For small and midsize businesses, Microsoft 365 email is where customer requests, invoices, payroll questions, vendor changes, contracts, insurance documents, tax records, password resets, and leadership decisions often pass through. If an attacker can silently control what a user sees or does not see, they may be able to turn one stolen account into invoice fraud, data exposure, customer impersonation, or a larger compromise.

Why This Topic Is Timely

Mailbox rule abuse is not new, but it deserves more attention because attackers are automating post-compromise activity in cloud email.

In April 2026, Proofpoint reported that approximately 10% of compromised Microsoft 365 accounts it analyzed from Q4 2025 had malicious mailbox rules created shortly after initial access. Proofpoint also noted that some rules were created within seconds of compromise, showing how quickly attackers can move once an account is opened.

Microsoft's own Defender XDR investigation playbooks describe malicious inbox manipulation rules and suspicious inbox forwarding rules as common during business email compromise and phishing campaigns. Microsoft notes that attackers may use rules to forward messages externally, delete or hide email, move messages to less visible folders, and manipulate communications after gaining mailbox access.

The financial stakes are real. The FBI's 2025 IC3 Annual Report listed Business Email Compromise as one of the highest-loss internet crime categories, with more than $3 billion in reported losses for 2025.

The keyword cluster is strong and buyer-relevant: Microsoft 365 mailbox rule abuse, suspicious inbox rules, Microsoft 365 forwarding rules, business email compromise, account takeover response, Exchange Online mailbox compromise, invoice fraud prevention, and Microsoft 365 security for small business.

This topic fits a real buyer concern: "If someone gets into our email, how would we know, and what should we check before we assume the account is clean?"

What Mailbox Rules Are Supposed to Do

Inbox rules are normal productivity features. Employees use them to organize email, move newsletters, flag customer requests, sort manager messages, copy mail to folders, or route alerts to a shared process.

Forwarding can also be legitimate. A user may forward mail to a shared mailbox, a ticketing system, a CRM, or another approved business workflow.

The problem is that the same feature is useful to attackers.

After compromising a mailbox, an attacker may create a rule that:

• forwards messages with words like "invoice," "payment," "wire," "ACH," "bank," "quote," or "password"
• moves security alerts to RSS Subscriptions, Archive, Deleted Items, or another folder the user rarely opens
• deletes replies from a vendor, customer, bank, or IT support
• marks messages as read so the user does not notice new activity
• hides warnings from Microsoft, a bank, payroll, or another cloud service
• forwards all incoming mail to an outside address
• moves messages from a specific sender so a fraud conversation can continue quietly

To the business, the mailbox may look mostly normal. To the attacker, it becomes a surveillance point.

Why Password Resets Do Not Fully Solve This

A password reset is important after account compromise, but it does not automatically remove the attacker's mailbox rules.

That is the dangerous part.

If the business resets a password but leaves malicious forwarding or hiding rules in place, the attacker may continue receiving useful information or the user may continue missing important messages. Even if the attacker's live session is revoked, the mailbox may still be configured in a way that helps the attacker.

This is why account compromise response should include mailbox inspection, not only identity cleanup.

A better question is:

What changed inside the mailbox while the attacker had access?

That question should lead to a review of inbox rules, forwarding, delegated access, sent mail, deleted mail, OAuth app consent, MFA methods, sign-in activity, and any business process touched by the account.

How Attackers Use Malicious Rules

Mailbox rule abuse often supports business email compromise because it gives the attacker time, visibility, and control.

1. Watching for Payment Opportunities

Attackers frequently search compromised mailboxes for invoices, quotes, payment terms, bank details, purchase orders, and vendor relationships.

A rule can forward payment-related messages to the attacker automatically. The attacker can then wait for a real invoice conversation and insert themselves at the right moment with changed bank details or a fake payment instruction.

The fraud looks believable because it is based on a real business conversation.

2. Hiding Security Warnings

Rules can move or delete security notifications from Microsoft 365, banks, payroll platforms, password managers, and other cloud services.

That can keep the user from seeing messages about new sign-ins, MFA changes, password resets, suspicious activity, or app permissions. It can also suppress warnings from customers or coworkers who notice something strange.

If the user never sees the alert, the attacker gets more time.

3. Suppressing Replies During Fraud

During invoice fraud or vendor impersonation, attackers may send a message from the compromised account or continue a thread using lookalike infrastructure.

Mailbox rules can hide replies from the real vendor, customer, or employee. That makes it easier for the attacker to control the conversation and prevent the victim from seeing contradictory information.

4. Creating Persistence Without Malware

Mailbox rules do not require malware on a workstation. They are built into the cloud email platform.

That makes them attractive to attackers. The activity may not trigger traditional endpoint alerts, and a busy user may not notice a new rule with a vague name such as ".", "..", "RSS", "Archive", or "Sync."

The attacker is abusing normal functionality, which is why monitoring and review matter.

5. Expanding the Attack

A compromised mailbox can be used to target others.

Attackers may send phishing emails from the real account, collect internal names and roles, learn approval workflows, identify customers, and prepare more convincing messages. Rules help them stay hidden while they learn.

For small businesses, this can damage more than one mailbox. It can affect customers, vendors, reputation, cash flow, and trust.

Warning Signs Small Businesses Should Notice

Mailbox rule abuse is often quiet, but there are patterns worth watching.

Treat these as warning signs:

• a user says expected messages are missing
• customers or vendors report strange replies the user cannot find
• security alerts are found in deleted, archive, junk, or RSS folders
• a mailbox has new rules the user does not recognize
• rules have odd names such as ".", "..", ",", "1", "RSS", or blank-looking labels
• rules forward mail to external addresses
• rules target words like invoice, payment, bank, phish, password, alert, MFA, or suspicious
• a mailbox starts sending unexpected messages to customers or vendors
• a user receives replies to messages they did not knowingly send
• finance receives a payment change request connected to a recent email compromise
• a password was reset, but suspicious email behavior continues

None of these proves fraud by itself. Together, they justify a deeper review.

What To Check After a Microsoft 365 Account Compromise

When a Microsoft 365 user may be compromised, small businesses should avoid a narrow response. The mailbox, identity, and business workflow all need attention.

1. Revoke Sessions and Secure the Account

Contain active access first.

That may include blocking sign-in, revoking sessions and refresh tokens, resetting the password after containment, requiring MFA re-registration if needed, and reviewing authentication methods for anything the user does not recognize.

Do not only change the password and move on.

2. Review Inbox Rules and Forwarding

Check Outlook rules, Exchange Online inbox rules, forwarding settings, transport rules where relevant, and any mailbox-level forwarding configuration.

Look for:

• external forwarding
• rules that delete, move, or mark messages as read
• rules tied to finance, invoice, security, password, MFA, payroll, bank, or vendor keywords
• rules with unusual names
• rules created around the time of suspicious sign-in activity
• rules the user cannot explain

If a malicious rule is found, remove it and preserve enough detail for the incident record.

3. Search for Business Impact

Mailbox cleanup is not enough if fraud was attempted.

Review sent items, deleted items, recoverable items where practical, audit logs, message trace, and conversations with customers, vendors, banks, payroll providers, and internal finance users.

Ask:

• Were payment instructions changed?
• Were invoices intercepted or altered?
• Were customers or vendors contacted?
• Were sensitive attachments accessed or forwarded?
• Were security alerts hidden?
• Did the attacker create or join ongoing conversations?

The goal is to understand business exposure, not just remove the rule.

4. Check Delegated Access and Shared Mailboxes

Attackers may abuse mailbox permissions, shared mailboxes, or delegation.

Review whether the compromised user has access to finance, HR, executive, sales, support, or shared operational mailboxes. Check whether new delegates, mailbox permissions, or send-as/send-on-behalf rights appeared during the compromise window.

Shared mailboxes deserve extra care because they often support customer communication and payment workflows.

5. Review OAuth Apps and Connected Services

Some attackers maintain access through malicious application consent rather than only username and password access.

Review enterprise applications, user consent grants, mailbox-related permissions, and suspicious apps connected near the compromise window. Remove anything unknown, unused, or excessive.

This is especially important if the compromise started through a consent phishing attack or a fake Microsoft permissions prompt.

6. Notify the Right People Internally

If the mailbox touches money, HR, legal, customer data, or leadership decisions, the response should include the business owners of those processes.

Finance may need to verify recent payment changes. HR may need to check payroll requests. Sales or support may need to warn customers. Leadership may need to decide whether legal, insurance, or customer notification steps are required.

Technical cleanup is only one part of incident response.

Prevention: Reduce the Chance and the Damage

Mailbox rule abuse is a post-compromise tactic, so prevention starts with reducing account takeover risk. But small businesses also need monitoring and process controls for what happens after access.

1. Require Strong MFA for Every User

Every active account should have MFA. Owners, finance users, HR, administrators, and users with broad access should receive stronger protection.

Where practical, move high-risk users toward phishing-resistant authentication such as passkeys, FIDO2 security keys, Windows Hello for Business, or Conditional Access authentication strengths.

MFA reduces risk, but it does not remove the need to monitor mailbox changes.

2. Tune Conditional Access

Conditional Access should cover the users, apps, devices, locations, and authentication flows that matter.

Review administrator access, risky sign-ins, unmanaged devices, legacy authentication, device code flow, trusted location exceptions, and high-risk business roles. Policies in report-only mode do not protect the business until they are enforced.

3. Restrict External Forwarding

Many small businesses should block automatic external forwarding by default unless there is a documented business reason.

If forwarding is needed for a ticketing platform, CRM, archive, or vendor workflow, document it and monitor it. Unknown external forwarding should not be treated as normal.

4. Monitor Suspicious Inbox Rules

Microsoft Defender XDR and Microsoft Defender for Office 365 can surface alerts related to suspicious inbox manipulation and forwarding rules, depending on licensing and configuration.

Even without a large security team, a small business should have an owner for reviewing these alerts and a process for deciding what happens next.

Monitoring is only useful when someone responds.

5. Protect Finance and Vendor Workflows

Business email compromise succeeds when technical access meets weak process.

Create written rules for:

• vendor bank changes
• wire or ACH requests
• payroll changes
• gift card requests
• customer refund changes
• urgent executive payment requests
• new payment portals

Use a second channel that is already trusted. Do not use the phone number or link provided in the email thread that may be compromised.

6. Train Employees on Specific Signs

Employee guidance should be concrete.

Teach users to report:

• missing expected messages
• unexplained mailbox rules
• strange replies from customers or vendors
• unexpected MFA prompts
• payment changes requested by email
• security alerts found outside the inbox
• sent messages they do not remember sending

"Watch out for phishing" is too broad. Employees need to know what mailbox compromise looks like in daily work.

7. Run Periodic Microsoft 365 Reviews

Microsoft 365 security changes over time. Employees join and leave. Apps are connected. Rules are created. Shared mailboxes grow. Vendors change. Exceptions accumulate.

A quarterly review should include:

• active users and stale accounts
• administrator roles
• MFA and authentication methods
• Conditional Access policies
• inbox rules and forwarding
• shared mailbox permissions
• external forwarding controls
• OAuth applications and consent grants
• Defender for Office 365 policies
• audit logging and alert ownership
• account compromise response steps

Small reviews prevent large surprises.

A Practical Mailbox Compromise Checklist

Use this checklist when a Microsoft 365 mailbox may have been compromised:

• Block sign-in if active abuse is suspected.
• Revoke active sessions and refresh tokens.
• Reset the password after containment.
• Review MFA methods and remove anything suspicious.
• Check sign-in logs for unfamiliar locations, devices, and apps.
• Review inbox rules, forwarding, and mailbox settings.
• Remove malicious rules and document what they did.
• Search sent, deleted, archive, and hidden folders for suspicious activity.
• Check message trace and audit logs where available.
• Review delegated access and shared mailbox permissions.
• Review OAuth app consent and connected applications.
• Verify recent payment, payroll, and vendor changes.
• Notify affected internal teams and external parties when appropriate.
• Preserve evidence for insurance, legal, or compliance needs.
• Add detection or process improvements so the same gap is less likely next time.

The checklist should be written before an incident, not invented during one.

What CybarWorks Recommends

Small businesses should treat mailbox rules as part of Microsoft 365 security, not just a user preference buried inside Outlook.

The highest-value improvements are straightforward:

1. Enforce MFA and improve authentication for high-risk users.
2. Block or tightly control external forwarding.
3. Monitor suspicious inbox rule and forwarding alerts.
4. Review mailbox rules during every account compromise response.
5. Protect finance and vendor workflows with second-channel verification.
6. Review Microsoft 365 identity, email, sharing, and app consent settings on a regular schedule.

CybarWorks helps small and midsize businesses secure Microsoft 365 in the places attackers actually exploit: identity, email, mailbox rules, forwarding, Defender policies, Conditional Access, app consent, shared mailboxes, and business approval workflows.

If your business is not sure whether a compromised mailbox would be caught quickly, contact CybarWorks. We can review your Microsoft 365 tenant, identify the highest-risk gaps, and build a practical plan to reduce account compromise and business email compromise risk.

Works Cited

• Proofpoint, Mailbox rules in O365 - a post-exploitation tactic in cloud ATO
• Microsoft Learn, Alert classification for suspicious inbox manipulation rules
• Microsoft Learn, Alert classification for suspicious inbox forwarding rules
• Microsoft Learn, Detect and remediate Outlook rules and custom forms injections attacks in Office 365
• FBI Internet Crime Complaint Center, 2025 IC3 Annual Report