What happens when mail forwarding rules stay open in cloud apps?

How open mail forwarding rules create hidden persistence

When forwarding stays enabled, the mailbox can keep sending copies of new mail to an external destination even after the owner changes their password. That turns a normal convenience feature into a quiet persistence path, because the attacker no longer needs to stay logged in every time they want visibility into incoming messages.

In cloud email platforms, the practical danger is not just exfiltration, but also stealth. A forwarding rule can sit below the level of everyday user activity, so the compromise may survive routine password resets, remain unnoticed during a quick inbox review, and continue collecting sensitive mail until someone inspects the rule set itself.

That is why recovery guidance for a hijacked mailbox has to include rule review as a first-class step. The Hacked Social Media or Email Account Recovery Guide puts forwarding rules, session sign-out and recovery details into the same response flow, because removing visible access without clearing hidden mail flow leaves the compromise partly intact.

What attackers gain from open forwarding rules

Open forwarding rules are valuable to attackers because they convert one mailbox compromise into ongoing message interception. That can expose password resets, internal approvals, invoices, HR correspondence, customer data and other messages that let the attacker move from simple account access to wider business abuse.

The technique is especially effective in cloud email because the attacker can hide in routine mail behaviour instead of using loud malware or repeated logins. The mailbox owner may still be able to sign in, send mail and receive mail normally, while the attacker receives a parallel copy outside the tenant.

The same pattern often appears alongside broader business email compromise activity. NHIMG’s Business Email Compromise Response Playbook treats inbox rules and forwarding as part of the compromise cleanup because mail access is often the control plane the attacker uses to monitor, redirect or time follow-on fraud.

How to confirm the rule is really closed

Confirmation needs to go beyond asking whether the user still has access. You need to verify the rule list, transport rules, delegates, connected apps and any mail routing changes at the tenant level, because forwarding can be set in more than one place and may persist after a password reset.

For cloud estates, this should be checked through admin auditing rather than mailbox-by-mailbox guesswork. The Cloud Detection Engineering Guide is useful here because forwarding changes are easiest to catch when you know which native audit events, log sources and detections map to mailbox rule creation, rule modification and admin-level mail flow changes.

Where the question is about exposure rather than just response, assume the rule may have been used to access sensitive mail before it was noticed. If the mailbox contained security alerts, password resets or approval chains, treat that as evidence that a broader account review is needed, not just a forwarding-rule cleanup.

Risk and Threat Considerations

Open forwarding rules create a low-noise compromise path because they let an attacker keep receiving mail without constant interaction with the account. That means the main security risk is continued visibility into sensitive content, plus the chance that the mailbox is being used as a reconnaissance point for fraud or deeper compromise.

Failure mechanism: The attacker establishes a rule or hidden mail flow that copies messages to an external address, then relies on the rule surviving password changes, partial cleanup or incomplete investigations.

Impact: Sensitive data can be exfiltrated over time, security workflows can be monitored in real time, and the attacker can remain embedded even after the user believes the mailbox has been recovered.

Practitioner Guidance

What to verify: Check the mailbox rule set, tenant mail flow configuration, delegates, OAuth grants and recent sign-in activity before declaring the account clean. If you only reset credentials, you may leave the original collection path untouched.

Decision rule: If the mailbox has access to sensitive approvals, finance, support or reset traffic, treat open forwarding as an incident response issue, not a routine hygiene task. The sensitivity of the mailbox determines how aggressively you should search for follow-on abuse.

What good looks like: Forwarding is either explicitly prohibited or tightly approved, audited and logged, and any exception is visible to both the mailbox owner and the admin team. Hidden rule changes should be rare enough that any new one is immediately explainable.

Practitioner takeaway: The real test is not whether the user can still log in, but whether the mailbox still has an unobserved path for messages to leave the tenant.

Related resources from NHI Mgmt Group

• How should security teams govern external mail forwarding rules?
• Why do cloud-native application risks stay open for so long in modern delivery pipelines?
• What happens when organisations rely on open cloud security tools at scale?
• What happens when a Jira instance is scanned without separating cloud and on-prem authentication rules?