Forwarding rule abuse is the misuse of email forwarding rules to divert messages to an attacker-controlled mailbox. In practice, an attacker creates or alters rules in an email account to silently copy, hide, or auto-forward mail, often after stealing a password, token, or session. It gives persistent access to correspondence and password reset messages.
How Forwarding Rule Abuse Works
Forwarding rule abuse turns a normal mailbox feature into a covert persistence mechanism. Once an attacker can change rules, they can quietly redirect selected messages, copy everything to a second mailbox, or hide security alerts so the account holder sees less than the attacker does.
The abuse is especially dangerous because it does not require malware on the endpoint once the mailbox is compromised. A stolen password, token, or active session can be enough to create rules that keep working until they are found and removed.
Why It Is Valuable to Attackers
Forwarding rules are attractive because they expose the flow of communication rather than just a single inbox. That can reveal password reset emails, approval requests, invoice details, internal discussions, and other messages that support fraud, impersonation, or further account takeover.
The attacker also gains a stealth advantage. Messages can be copied elsewhere while still reaching the victim, or they can be filtered into less visible folders, which delays suspicion and can prolong access across password changes if the session or rule remains intact.
Common Abuse Patterns and Where They Hide
Abusive rules often look like convenience features at first glance. They may auto-forward messages to an external address, match on specific sender names or subject lines, move security notifications out of view, or delete evidence after delivery.
In cloud email systems, forwarding abuse often appears alongside mailbox-rule tampering, hidden inbox rules, or consent-based mailbox access. That is why rule review matters as much as password hygiene: the compromise may persist in the mailbox even after the original login method is recovered.
Detection usually depends on mailbox audit logs, rule-creation events, unusual forwarding destinations, and changes that coincide with a suspicious sign-in or token use. For operational detection detail, the mailbox-rule patterns described in the T1114 Email Collection Defensive Guide and the broader logging approach in the Microsoft 365 Unified Audit Log Guide for Detection are directly relevant.
Prevention, Recovery, and Review
Defending against forwarding rule abuse means treating mailbox rules as security-relevant configuration, not just user convenience. Strong authentication reduces the chance of initial compromise, but it does not replace the need to inspect rules, revoke sessions, and remove hidden forwarding paths after suspicious activity.
Recovery should include a full mailbox review, rule deletion, session revocation, password or token reset, and a check for related compromise paths such as malicious app consent or delegated mailbox access. If the mailbox is part of a broader business email compromise event, the response needs to extend beyond the inbox to fraud monitoring and contact-risk review.
For practitioners, the most useful reference points are the mailbox hardening guidance in the Exchange Online Security Guide and the recovery steps in the Hacked Social Media or Email Account Recovery Guide. When the abuse is part of a fraud chain, the Business Email Compromise Response Playbook adds the incident-response actions that follow mailbox cleanup.
Risk and Threat Considerations
Forwarding rule abuse creates persistent confidentiality and integrity risk because it lets an attacker observe or redirect communications after the first compromise. The main danger is not just inbox access, but silent interception of password resets, approvals, invoices, and other messages that can be used to escalate fraud or maintain control.
Failure mechanism: The attacker abuses mailbox rules or forwarding settings after stealing a password, token, or session, then keeps the rule active long enough to divert or suppress important mail without immediate visibility.
Impact: The account holder may lose trust in the mailbox, miss security notifications, and face follow-on compromise, including account reentry, payment fraud, or broader business email compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Forwarding abuse often follows stolen credentials, tokens, or sessions. |
| AU-6 — Audit Review, Analysis, and Reporting | Mailbox rule changes and forwarding events must be reviewed to spot abuse. | |
| AC-6 — Least Privilege | Rule and mailbox access should be limited so attackers cannot persist quietly. | |
| Recommendation — Rotate compromised authenticators and revoke stale mailbox access after suspicious forwarding changes. Review mailbox audit events for rule creation, forwarding changes, and related sign-in anomalies. Restrict who can manage forwarding, mailbox rules, and delegated mail access. | ||
| OWASP API Security Top 10 | API5 — Broken Function Level Authorization | Mailbox management APIs can expose rule-setting functions if authorization is weak. |
| Recommendation — Verify that only authorized actors can change mailbox forwarding and rule settings. | ||
| MITRE ATT&CK | T1114 — Email Collection | Forwarding rule abuse is a common way to collect mailbox content covertly. |
| Recommendation — Map suspicious forwarding and inbox-rule activity to T1114 and hunt for covert mail collection. | ||
Practitioner Guidance
What to watch for: Treat rule creation, hidden forwarding, and unexpected inbox filtering as security events, especially when they follow a suspicious sign-in or occur in accounts that receive password resets or finance-related mail.
Governance implication: Mailbox rules should be reviewable, auditable, and removable by responders, with clear ownership for who checks them during account recovery and incident response. That is especially important for shared or high-value mailboxes where one hidden rule can affect multiple business processes.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org