The Hidden Email Rule Hackers Leave Behind

Changing your password does not remove a rule someone else left in your mailbox. If an attacker got into your account and created an inbox rule, that rule stays in place until you find it and delete it yourself.

This briefing covers what rules can do, how attackers use them, and where to look in Outlook on the web and in Gmail.

What inbox rules can do

Inbox rules are a standard email feature. They act on incoming messages automatically, based on conditions you set.

A rule can forward a message to other recipients. It can forward a message as an attachment. It can also redirect a message, which means the message is not delivered to your mailbox at all.

Rules can also move messages to another folder, or delete them as they arrive. Used normally, that is filing and sorting. In the wrong hands, the same actions move mail out of sight, or out of the account entirely.

Microsoft's compromised-account response guide tells responders to inspect inbox rules and check whether mail is being forwarded or redirected.

How attackers use rules after a break-in

Proofpoint documents mailbox rules as a post-exploitation tactic after a cloud account takeover. Once an attacker is inside an account, a rule gives them a quiet way to keep watching it.

One pattern is forwarding. A rule can send copies of your incoming mail to an address the attacker controls, so they see messages without signing in again each time.

The other pattern is hiding. Proofpoint documents a rule that moves messages from a targeted sender into a rarely checked folder, such as RSS Subscriptions, so verification mail and correspondence stay out of the inbox where you would normally see them.

Proofpoint also documents rules used to hide replies and clarification requests, and to suppress security alerts. The messages that would tell you something is wrong never reach the place you look first, so you stay unaware of ongoing misuse.

For the wider cleanup sequence, see account recovery after a compromise.

Why a password change is not enough

A password change and a rule removal are two separate steps. Microsoft's guidance on suspicious email forwarding activity lists them in that order: first disable and delete the inbox forwarding rule, then reset the user's account credentials.

The reason is simple. Rules live on the mailbox, not on your password. Changing the password changes how you sign in. It does not delete a rule someone else created while they had access.

That is the trap. You can set a strong new password and feel finished, while a forwarding or hiding rule is still running underneath. The account looks secured. The mail is still being copied or hidden.

Do both steps, in that order. Remove the rule first, then change the password. To generate and store that new password, see password managers, explained plainly.

Where to check in Outlook on the web

Open Outlook on the web and go to Settings, then Mail, then Rules. That list shows your inbox rules. Read every entry and ask whether you created it yourself.

Then go to Settings, then Mail, then Forwarding. That screen shows whether automatic forwarding is enabled. If forwarding is on and you did not turn it on, treat that as a finding, not a setting to leave alone.

Check both places. A forwarding rule and the separate Forwarding setting are not the same thing, and either one can send your mail elsewhere.

Where to check in Gmail

In Gmail, open Settings, then choose See all settings. Open the Forwarding and POP/IMAP tab. That tab shows the forwarding state for the account, including whether forwarding is set up.

Then open Filters and Blocked Addresses. That list shows your filters. In Gmail, a filter can forward mail, delete it, skip the inbox, or mark mail as read. Any of those actions can hide a message from normal view.

Read both lists in full. A filter you do not recognise gets the same response as an unfamiliar Outlook rule: remove it, then secure the account.

For a common entry point, see consent phishing.

What to do if you find a rule you did not create

Delete any rule or filter you did not create. Do not edit it and leave it in place, and do not leave a forwarding address you do not recognise on the account.

Then change your password. Use a new password you have not used on this account before.

Then check your sign-in and verification methods. Remove anything you do not recognise.

Do this check today, even with no sign of a break-in. Open Rules and Forwarding in Outlook, or the Forwarding tab and Filters in Gmail, and count the entries you never made. If the count is zero, you have confirmed it. If it is not zero, you have found the step a password change alone would have missed.

Sources: Microsoft Learn — Responding to a Compromised Email Account ↗ · Proofpoint Threat Insight — Mailbox rules in O365 ↗ · Microsoft Learn — Alert classification for suspicious email forwarding activity ↗ · Microsoft Learn Answers — Potentially compromised account ↗ · Gmail settings that reveal unauthorized access ↗