The quiet inbox rule that leaks your email for months

A staff member’s password gets phished. The attacker logs in, and instead of making noise, they do something quiet: they add a rule to the mailbox that forwards a copy of every email to an address you’ve never heard of. Then they log out. Nothing looks broken. And for weeks, sometimes months, everything that lands in that inbox lands in theirs too.

Why attackers love this

It’s one of the first things a lot of intruders do after they get into an email account, and it’s popular precisely because it’s boring and invisible. A forwarding rule (or a rule that quietly files certain messages into a folder you never open) means they don’t have to log back in and risk being noticed. They just wait and read.

For a business that emails invoices, contracts, settlement details or client information, that’s a slow leak of exactly the stuff that should never leak. It’s also how a lot of invoice-redirection fraud begins: the attacker watches a real payment conversation unfold, then steps in at the right moment with new bank details that look completely legitimate.

What to do about it

None of this is hard to check. The problem is that almost nobody does.

• Look at the rules on your mailboxes. In Microsoft 365 or Google Workspace, check for forwarding rules and inbox rules you didn’t create, especially any that send mail to an outside address or hide messages in an odd folder.
• Block automatic external forwarding by default. Most businesses don’t need it, and both Microsoft 365 and Google let you switch it off across the whole organisation in one place.
• Turn on multi-factor sign-in. It stops most of these break-ins before a rule ever gets set.
• Treat a mystery rule as a break-in. If you find one you didn’t set, reset the password, remove the rule, and check what was sent while it was active.
• Give it an owner. Rules get checked once and then forgotten. This should be part of how your systems are looked after, not a one-off spring clean.

The takeaway

The attacks that make headlines are loud. This one is quiet, and that’s the whole point. A single inbox rule can turn one phished password into months of silent access to everything you send. Finding it takes minutes, and it’s the kind of thing that should just be handled for you in the background.