Mailbox rules are a stealth persistence layer in Microsoft 365

At a glance

What this is: Proofpoint shows that mailbox rules in Microsoft 365 are being abused as a stealth persistence and exfiltration mechanism, not just an inbox convenience feature.

Why it matters: IAM and security teams need to treat mailbox rule creation as a post-compromise control signal because it can outlive password resets, suppress alerts, and conceal third-party communications.

By the numbers:

• Approximately 10% of compromised user accounts had at least one malicious mailbox rule created shortly after initial access in Q4 2025.

Context

Mailbox rules are built into Microsoft 365 to help users sort, forward, and suppress messages. That same convenience becomes a governance gap when a compromised identity can silently alter mail flow, hide warnings, and preserve access after the original password is changed.

The risk is not limited to email hygiene. In identity terms, mailbox rules can become a persistence layer for business email compromise, vendor impersonation, and suppressed incident signals, which means email controls, IAM telemetry, and third-party access monitoring need to be evaluated together.

Proofpoint's analysis shows that this is already a routine post-exploitation pattern rather than an edge case. The operational problem is not whether Microsoft 365 can create rules, but whether organisations can detect when those rules are being used as covert access control.

Key questions

Q: What breaks when malicious mailbox rules are not monitored?

A: When mailbox rules are not monitored, attackers can hide security alerts, suppress password resets, redirect vendor mail, and preserve covert access after the initial compromise. The mailbox still looks functional to the user, but the attacker controls what evidence and responses are visible. That turns a normal email account into a persistence and fraud channel.

Q: Why do malicious mail rules increase the impact of business email compromise?

A: Malicious mail rules matter because they let attackers automate stealth, exfiltration, and persistence after they get into a mailbox. A rule can hide warning messages, forward sensitive mail to an external account, or delete messages from specific senders. That gives the attacker time to impersonate executives, monitor investigations, and continue harvesting data even if the victim changes their password.

Q: How can security teams detect mailbox-rule abuse early?

A: Watch for new rules that forward externally, delete messages, or route mail into obscure folders, especially when they appear within minutes of account compromise. Correlate those changes with risky sign-ins, OAuth consent events, and unusual user agents. Early detection depends on linking mailbox behaviour to identity telemetry.

Q: What should teams do after a mailbox is used to send malicious internal email?

A: They should disable the account, force a password reset, contain any endpoints that interacted with the message, and remove any remaining malicious email. After that, they should review authentication logs, mailbox rules, and access policies to prevent the same path from recurring.

Technical breakdown

How mailbox rules become a post-compromise persistence layer

Mailbox rules operate inside the mail platform, so they do not require malware, packet interception, or custom infrastructure. An attacker with valid access can create forwarding, delete, mark-as-read, or move actions that change what the user sees while leaving the account apparently functional. Because the logic lives in the mailbox itself, the rule can continue after password changes unless the rule is removed and sessions are revoked. That makes the mailbox a control plane for message visibility, not just a storage location.

Practical implication: monitor rule creation as a post-authentication event and tie it to session revocation, not just password resets.

Why hidden folders and suppression actions matter for identity governance

Attackers use rules to redirect mail into Archive, RSS Subscriptions, or other low-visibility folders, or to delete messages outright. Those actions suppress alerts, password reset mail, and MFA-related notifications, which means the victim is less likely to see the signals that would reveal compromise. This is a governance issue because the identity still appears valid while the communication channel that would expose misuse has been selectively blinded. The account becomes trustworthy-looking to the platform and untrustworthy in practice.

Practical implication: include mailbox-rule review in incident triage whenever email alerts stop matching user behaviour.

How third-party services turn mailbox rules into a communication foothold

The article shows attackers using mailbox rules to hide verification emails and third-party correspondence while registering external services, spoofing domains, and hijacking existing threads. That combination creates a man-in-the-middle-like effect at the application layer: the attacker controls what both sides see without needing network positioning. In identity terms, the rule is not just hiding mail, it is enabling delegated fraud by preserving the attacker’s presence inside vendor communications and business workflows.

Practical implication: treat third-party registration emails and thread anomalies as identity signals, not only email-security events.

Threat narrative

Attacker objective: The attacker wants covert access to email traffic, persistent visibility into the victim's communications, and a channel for fraud or impersonation that survives routine account recovery.

1. Entry typically begins with credential phishing, password spraying, brute force, or OAuth consent abuse against a Microsoft 365 account.
2. Credential access then gives the attacker enough privilege to create malicious mailbox rules that forward, delete, or hide messages without alerting the user.
3. Escalation occurs when those rules are used to suppress warnings, harvest vendor communication, and maintain visibility into the mailbox after password changes.
4. Impact is sustained business email compromise, hidden fraud activity, and continued data leakage through a native persistence layer inside Microsoft 365.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Canvas Instructure Data Breach: ShinyHunters exploits Canvas LMS platform to expose millions of student records via third-party NHI credential abuse.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Mailbox rules are now a persistence control boundary, not an inbox feature: The security significance of native rule creation is that it changes how long a compromised identity can remain operational. If password resets do not remove the rule, then the persistence condition lives outside the password lifecycle. Practitioners should treat rule creation as evidence that the identity has crossed from access abuse into post-compromise control.

Stealth persistence in Microsoft 365 collapses the assumption that identity recovery ends compromise: The mailbox can still be weaponised after the original credential is replaced because the attacker has embedded control in message flow, not just authentication. That assumption breaks standard recovery thinking and makes mail rules part of the account's effective privilege surface. The implication is that identity governance has to observe post-authentication behaviour, not only login state.

Hidden-folder routing creates an identity blast radius inside everyday communications: Moving mail to Archive, RSS Subscriptions, or similar folders gives attackers a low-friction way to suppress alerts and redirect vendor conversations. This is not just message hygiene failure; it is a visibility failure that expands the blast radius of a single compromised account into payroll, procurement, and third-party trust relationships. The practitioner conclusion is that email visibility controls belong in the same governance conversation as account recovery.

Mailbox-rule abuse is a reusable fraud pattern, not a one-off tradecraft choice: Proofpoint's analysis shows that attackers can use the same technique to support BEC, internal phishing, vendor impersonation, and multi-account automation. The named concept here is mail-flow persistence debt: organisations carry unresolved risk whenever mail-routing controls are not inventoried, monitored, and revoked with the same discipline as credentials. Teams should reclassify these rules as governed identity state.

Third-party email services amplify the identity risk beyond Microsoft 365: When a hidden inbox rule protects verification mail and setup messages, the compromised account becomes a bridge to additional infrastructure and spoofed domains. That widens accountability gaps because the original mailbox, the external service, and the fraudulent thread all depend on one uncontrolled identity event. The conclusion is that third-party email onboarding must be watched as part of NHI and human account compromise response.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Identity Threat Detection and Response (ITDR) Guide

What this signals

Mailbox rules deserve the same governance attention as credential lifecycle events: A rule that forwards, suppresses, or reroutes mail can be functionally equivalent to a standing access path because it preserves attacker visibility after the original login is lost. That makes mailbox-rule review a practical extension of identity threat detection, especially where recovery processes focus on passwords but not on mail-flow control.

Mail-flow persistence debt: This article sharpens a useful concept for practitioners. If a mailbox can be recovered without revoking the rules that control what the user sees, the organisation still carries hidden access debt inside the communication layer. The programme implication is to inventory and govern inbox rules as part of account recovery and post-compromise triage.

The combination of hidden folders, third-party service onboarding, and thread hijacking shows why email compromise cannot be managed as an isolated mail-security issue. Identity, vendor trust, and fraud workflows all intersect here, so the operational response has to span IAM telemetry, mailbox controls, and third-party access review.

For practitioners

• Audit inbox rule creation as a compromise signal Review newly created forwarding, deletion, and move rules alongside recent sign-ins, especially when the rule appears soon after first access or uses minimal, nonsensical names.
• Disable external auto-forwarding by default Block automatic forwarding to external addresses unless there is a documented business need and a monitored exception path.
• Revoke sessions after rule discovery Invalidate active sessions and refresh tokens when malicious rules are found so access does not persist after password change.
• Check hidden folders during mailbox triage Inspect Archive, RSS Subscriptions, and other low-visibility folders for suppressed alerts, password reset messages, or vendor replies.
• Correlate mailbox rules with OAuth grants Review new consent grants and mail-scoped applications when a mailbox shows unusual rule activity, because token-based access can automate rule deployment.

Key takeaways

• Mailbox rules can function as a stealth persistence layer inside Microsoft 365, allowing attackers to hide mail, suppress alerts, and maintain visibility after compromise.
• Proofpoint observed malicious mailbox rules on about 10% of compromised accounts in Q4 2025, showing this is a common post-exploitation pattern rather than a rare edge case.
• The control gap is not just password hygiene. Organisations need rule-level detection, session revocation, and mailbox governance to reduce the blast radius of compromised identities.

Key terms

• Mailbox Rule Abuse: Mailbox rule abuse occurs when an attacker creates or changes email rules to redirect, hide, or preserve messages. It is an identity risk because the attacker is using legitimate platform behaviour to maintain visibility and persistence after access, often without triggering obvious authentication alerts.
• Mail-Flow Persistence: Mail-flow persistence is a post-compromise state where the attacker keeps influence over what the user receives or sees, even after the password changes. It matters because the persistence lives in mailbox logic and message routing, not just in authentication state.
• Thread hijacking: An attack where a malicious actor inserts or reuses messages inside an existing email conversation to appear legitimate. It works because recipients trust the thread history, making the message more likely to bypass suspicion and trigger a business action or credential disclosure.
• Hidden Folder Suppression: Hidden folder suppression is the use of inbox rules to move messages into low-visibility folders such as Archive or RSS Subscriptions. The technique reduces the chance that alerts, vendor replies, or password-reset mail are seen before the attacker completes fraud or further compromise.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.