Mailbox Rule Abuse Emerges as Stealthy Post-Compromise Threat

Researchers observed a surge in attackers abusing Microsoft 365 mailbox rules—creating stealthy forwarding, suppression, or deletion rules immediately after compromise—to exfiltrate data, hide alerts, hijack conversations, and persist even after password resets; Proofpoint reports about 10% of breached accounts in Q4 2025 contained malicious rules, and recommended defenses include disabling auto-forwarding, enforcing MFA, monitoring OAuth, removing malicious rules, revoking sessions, and auditing account activity.