The hidden inbox rule: how attackers stay in your mailbox after a password change
You spot a suspicious email, or someone reports an odd message coming from a staff member's account. You do the right thing: reset the password, force a sign-out, enable multi-factor authentication. Mission accomplished, right?
Not quite.
If an attacker has already gained access to a mailbox, they often set up what is called a hidden inbox rule before they do anything else. This single tweak lets them keep reading your emails even after you change the password and kick them out. It is one of the most common persistence techniques in Business Email Compromise attacks, and it is also one of the easiest to miss during an incident response.
How the hidden inbox rule works
Email platforms like Microsoft 365 Outlook allow users to create rules that automatically process incoming messages. A rule can move messages to a folder, delete them, forward them, or copy them somewhere else. Attackers exploit this feature in two main ways:
The forwarding rule. The attacker creates a rule that copies (or moves) all incoming mail to an address they control. This could be a Gmail account, a temporary inbox, or even another mailbox on the same tenant. The victim never sees their own messages until the attacker has already read them.
The hidden folder trick. The attacker creates a folder called something innocuous like "Archive" or "Reports", sets up a rule to move all mail there, and then hides that folder from the Outlook folder list. From the user's perspective, their inbox looks normal. In reality, every new email goes straight into the attacker's stash.
Both techniques achieve the same goal: continuous access to incoming communications without the victim noticing.
Why this matters for BEC attacks
The hidden inbox rule is not just a nuisance. It is a force multiplier for Business Email Compromise in several ways:
Delayed detection. The victim does not know their mailbox has been compromised until weeks or months later, by which time the attacker has gathered enough information to launch a real attack. This dwell time is critical. The longer attackers can read mail undetected, the more context they build about who makes payment decisions, what suppliers are in play, and when urgent transfers happen.
Trusted communications. Because messages arrive from legitimate addresses within your own domain, staff are far more likely to trust them. A request for a wire transfer that appears to come from the finance director inside your own organisation carries a weight of authority that an external email never could.
Bypassing security controls. Many organisations monitor outbound emails for fraud indicators but do not have equivalent visibility into mailbox rules. An attacker can read, copy, and act on sensitive information without triggering any alerts in the inbox itself.
Signs your mailbox may have a hidden rule
Detecting a malicious inbox rule requires looking beyond the inbox. Here are the tell-tale signs:
Missing emails. Staff report that they never received messages that should have arrived. This is the most common early indicator, but it is also the easiest to dismiss as "it must have gone to spam."
Out-of-office replies arriving unexpectedly. If an attacker sets up a rule to forward mail and also configures an automated response, legitimate senders may receive replies they did not expect.
Unusual folder structures. Check for folders that do not belong to the user, especially those named generically like "Archive," "Backup," or "Reports." In Outlook desktop, you can see all folders by right-clicking the mailbox name. In Outlook on the web, some hidden folders may not appear at all in the normal view.
Rule exceptions. Look for rules that apply to "all messages" or that forward mail to external addresses. These should never exist without explicit authorisation.
How to stop it before it starts
The best defence against the hidden inbox rule is a combination of technical controls and organisational habits:
Monitor mailbox rules centrally. Microsoft 365 provides audit logs for all mailbox rule creation, modification, and deletion events. These logs should be sent to your security monitoring platform with alerts for any new forwarding rule or external recipient. This is not optional for any business that handles financial transactions by email.
Restrict who can create rules. Use Microsoft 365 transport rules to block mail from being forwarded to external addresses. This does not prevent all persistence techniques, but it removes the most common one at a stroke.
Audit existing rules regularly. Run a quarterly review of all mailbox rules across your organisation. Look for rules that forward to personal email accounts, rules that apply to "all messages," and rules created outside normal business hours.
Enable mailbox auditing. Microsoft 365 mailbox auditing logs when users or administrators access mailboxes, create rules, or change settings. Make sure it is enabled for all user mailboxes and that audit events are retained long enough to investigate past incidents.
Train staff to report anomalies. If a colleague says they never received an email you know you sent, treat it as a potential compromise indicator rather than a technical glitch. Quick investigation at this stage can stop an attack before it gains traction.
What to do if you suspect a hidden rule is in place
If you believe your mailbox has been compromised and may have a malicious forwarding rule:
- Do not change the password yet. Changing the password first will disconnect the attacker but also alert them that they have been detected. Instead, go straight into the admin centre or Outlook settings and delete any suspicious rules first.
- Review the inbox rule list carefully. In Outlook on the web, go to Settings > Mail > Rules. In Outlook desktop, go to Home > Rules > Manage Rules & Alerts. Look for anything you did not create.
- Check hidden folders. Use the folder navigation pane in Outlook desktop or run a PowerShell command to list all folders associated with the mailbox.
- Force a full sign-out. Once you have removed any malicious rules, force all sessions to end and reset the password.
- Review audit logs. Check when the rule was created, what it does, and whether mail has been forwarded externally. This will help determine the scope of the compromise.
The bottom line
A password change is a necessary step in responding to a compromised account, but it is not sufficient on its own. If an attacker has set up a hidden inbox rule, they continue to read your mail regardless of what happens to the password.
The defence is straightforward: monitor mailbox rules centrally, restrict forwarding to external addresses, and audit existing rules regularly. These steps take minutes to implement but close one of the most dangerous gaps in Business Email Compromise defences.
If you are unsure whether your business has visibility into mailbox rule activity, reach out. We help local businesses set up the monitoring that catches these persistence techniques before they become full-scale breaches.