How do attackers use email forwarding rules?

Attackers use email forwarding rules to quietly copy incoming mail to another mailbox they control, which lets them monitor conversations, capture credentials, and follow business processes. They often create or alter rules after account compromise and hide them from the victim. Review mailbox rules, alert on new external forwarding, and restrict automatic forwarding where possible.

How email forwarding rules help attackers stay invisible

Forwarding rules let attackers turn a mailbox into a quiet relay. After compromise, they can copy selected or all inbound mail to an account they control, which gives them time to read replies, harvest credentials, and track payment, HR, or vendor workflows without immediately changing the victim’s login state.

That makes the rule itself an access path, not just an inbox convenience. If the attacker can preserve the victim’s normal access while siphoning mail externally, they can stay inside the business process long enough to exploit trust, approvals, password resets, and invoice handling.

An effective review therefore looks for both obvious and subtle abuse: new hidden rules, altered rules that filter by sender or subject, and any rule that forwards outside the organisation. A rule that deletes, archives, or marks mail as read after forwarding is often designed to reduce the chance of detection.

Why forwarding rules are so useful in a compromise chain

Email is usually where identity recovery, vendor changes, and financial approvals converge. A forwarded mailbox gives an attacker visibility into that stream, which can reveal password reset links, MFA enrolment prompts, procurement steps, and the language people use to approve sensitive actions.

Attackers also gain continuity. Even if the victim changes their password later, a forwarding rule may continue to send copies of future messages until someone finds and removes it. That makes mailbox-rule abuse a persistence mechanism, not just an initial foothold.

In practice, the attacker’s goal is often observation before action. They watch for patterns, learn who trusts whom, and wait for a message that lets them impersonate the victim or pivot into another account. The longer the rule remains active, the more business context they collect.

What defenders should inspect first in mailbox rule abuse

Start with rule provenance and destination, then move to behaviour. New rules created shortly after a suspicious sign-in, a password reset, or a consent grant deserve priority, especially when the destination is an external mailbox or the rule hides its own activity by deleting, moving, or suppressing notifications.

Mailbox rule review is most useful when it is paired with sign-in and message-flow evidence. Correlating rule creation with impossible travel, unusual sender patterns, or abnormal forwarding volumes helps distinguish routine user behaviour from attacker-driven persistence.

Where possible, Email Identity and BEC Guide is the right starting point for teams that need the broader context around mailbox takeover, forwarding abuse, and email impersonation. For incident-heavy threat context, The State of NHI & AI Agent Breach Report 2026 helps practitioners think about the kinds of credentials and access paths attackers typically try to preserve after compromise.

Risk and Threat Considerations

email forwarding rules create a quiet exfiltration path that is easy to overlook because the mailbox still appears usable to the victim. The risk is highest when forwarding is allowed externally, when rule changes are not logged or alerted on, and when attackers use the inbox to monitor reset links, finance workflows, or executive correspondence.

Failure mechanism: The attacker creates or modifies a rule after account compromise, then uses it to copy inbound mail to a controlled mailbox while keeping the victim’s normal workflow intact. Hidden or broad filtering rules make the abuse harder to notice and can extend the dwell time of the compromise.

Impact: The attacker can collect credentials, follow approvals, impersonate the user in downstream conversations, and turn a single mailbox compromise into broader fraud, data exposure, or additional account takeover.

Framework alignment

Email Identity and BEC Guide supports reviewing mailbox takeover and forwarding abuse as part of BEC detection and response.
The State of NHI & AI Agent Breach Report 2026 supports understanding post-compromise access persistence and credential-related attack paths.
NIST SP 800-53 Rev 5 Security and Privacy Controls supports auditing mailbox activity and restricting unauthorized access paths.
NIST Cybersecurity Framework 2.0 supports detecting mailbox-rule abuse and responding to account compromise.
MITRE ATT&CK Enterprise Matrix supports mapping email-rule abuse to credential access, persistence, and lateral movement behaviours.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	AU-2 — Event Logging	Mailbox rule changes need auditable events to spot covert forwarding.
	AC-6 — Least Privilege	Restricting mailbox settings limits who can create hidden forwarding paths.
Recommendation — Log mailbox rule creation, modification, and deletion events. Limit who can create or change external forwarding rules.
NIST CSF 2.0	DE.CM-01 — Network, environment, and physical events are monitored	Monitoring mailbox-rule changes helps detect suspicious forwarding activity.
	RS.AN-01 — Investigations are performed	Rule abuse after compromise needs investigation to confirm scope and persistence.
Recommendation — Monitor mailbox rule changes for suspicious external forwarding. Investigate suspicious forwarding rules as possible compromise indicators.
MITRE ATT&CK	T1114 — Email Collection	Forwarding rules are a common way to collect mailbox content from a compromised account.
Recommendation — Hunt for email collection and mailbox-rule abuse after account compromise.

Practitioner Guidance

What to prioritise: Treat any new external forwarding rule as a security event, not a mail preference. The first decision is whether the rule is legitimate business use or attacker persistence, because that determines whether you contain the mailbox immediately or simply monitor it.

What to verify: Confirm who created the rule, when it was created, whether it forwards externally, and whether it also hides or deletes messages. If the same account shows abnormal sign-in behaviour or recent password-reset activity, assume the rule may be part of a compromise chain rather than an isolated change.

Practitioner takeaway: The useful control is not just blocking forwarding, it is making mailbox-rule changes visible enough that an attacker cannot quietly convert email into a long-lived monitoring channel.