Hackers Create Hidden Mailbox Rules in Microsoft 365 to Intercept Sensitive Business Emails

**Hidden mailbox rules in Microsoft 365 are being abused by attackers to silently forward, hide, or manipulate emails after account compromise, enabling business email compromise, payroll fraud, and long-term persistence; Proofpoint observed malicious rules in roughly 40% of compromised accounts and rule creation occurring as fast as eight seconds post-compromise.** Recommended defenses include disabling automatic external forwarding, enforcing MFA with conditional access, auditing mailbox rules regularly, monitoring OAuth consent grants, revoking active sessions after suspected breaches, and reviewing Entra ID sign-in logs.