Loading story…
Attackers are increasingly using malicious Microsoft 365 mailbox rules after account compromise to silently forward, delete, hide, or mark emails as read, turning native email features into a persistence and surveillance mechanism. Reports citing Proofpoint found the technique in a significant share of compromised tenants, with some rules created within seconds of initial access, and warned that the rules can suppress MFA prompts, password reset messages, and security alerts while enabling continued monitoring of sensitive business communications.
The abuse typically follows credential phishing, password spraying, or OAuth consent attacks, and can persist even after password resets or MFA enrollment unless the rules are explicitly removed. Researchers said the method has featured in business email compromise and payroll fraud cases, including schemes using spoofed homoglyph domains and external mail services, and recommended auditing and deleting unauthorized inbox rules, disabling automatic external forwarding, revoking active sessions and refresh tokens, reviewing OAuth app permissions, and checking Entra ID sign-in logs for suspicious activity.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting described attackers creating malicious mailbox rules within seconds of account takeover and cited a payroll fraud case involving a hidden rule, a spoofed homoglyph domain, and Zoho. The reporting also emphasized common initial access vectors such as credential phishing, password spraying, and OAuth consent abuse.
Security researchers and practitioners highlighted that malicious Microsoft 365 mailbox rules can remain active even after password resets and MFA enrollment unless explicitly removed. This made the technique a recurring concern in business email compromise investigations because attackers could maintain access to sensitive email flows without direct login access.
Proofpoint reported that malicious mailbox rules were commonly created shortly after Microsoft 365 account compromise during Q4 2025. The rules were used for persistence, surveillance, and email exfiltration, including hiding security alerts and forwarding sensitive messages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft and other security researchers reported multiple campaigns in which attackers abused trusted cloud email environments to deliver phishing, spam, and business email compromise. In one Microsoft 365 intrusion set, attackers used credential stuffing against privileged accounts that lacked MFA, then registered malicious single-tenant OAuth applications with `Exchange.ManageAsApp` and elevated roles to persist in victim tenants. They modified Exchange Online inbound connectors and mail flow rules to relay scam email from legitimate organizational domains, promoting deceptive sweepstakes offers that harvested payment details for recurring subscriptions. Separately, Spamhaus identified more than 450 compromised Google Workspace education domains being used to send phishing and scam messages from real mailboxes, extending the same account-takeover model beyond Microsoft environments. Related reporting showed the same ecosystem of email abuse also supporting credential theft and financial fraud. Microsoft documented AiTM phishing operations using Evilginx2-style infrastructure to steal Office 365 passwords and session cookies, bypass MFA through cookie replay, and then access Outlook mailboxes, create inbox rules, and conduct payment fraud. Other campaigns used voicemail-themed HTML attachments, open redirect chains, Google reCAPTCHA gates, and spoofed Microsoft notifications such as Power BI alerts to harvest credentials at scale. Across the incidents, defenders were urged to enforce phishing-resistant MFA, disable legacy access, review forwarding rules and connected apps, monitor anomalous sign-ins and suspicious mailbox or transport-rule changes, and rapidly investigate compromised accounts being used as trusted sender infrastructure.
Aug 15, 2026
Threat actors are increasingly leveraging adversary-in-the-middle (AitM) phishing techniques to compromise Microsoft 365 accounts. In a recent incident, attackers used a phishing email with a malicious link that mimicked the Microsoft login page, capturing both credentials and session cookies to bypass multi-factor authentication (MFA). The attackers expanded their access through password spraying, brute force attacks, and the use of VPNs and residential proxies to evade detection. Persistence was achieved by manipulating inbox rules and abusing OAuth permissions via legitimate email clients, allowing continued access to compromised accounts. Traditional detection methods, such as URL reputation and static fingerprinting, are proving ineffective against these sophisticated AitM phishing kits, which proxy the real Microsoft authentication flow and associated assets. In response, security researchers have developed new defensive measures, including browser extensions that detect AitM attacks at the point of interaction by monitoring for unexpected HTTP referers and injecting visible warnings. However, as attackers adapt and proxy more elements of the authentication process, even these advanced defenses face challenges, highlighting the need for continuous innovation in anti-phishing strategies.
Jun 29, 2026
Attackers abused Microsoft’s legitimate authentication and Microsoft 365 infrastructure to run phishing and business email compromise campaigns without relying on fake login pages. Check Point observed more than 200 phishing emails sent to about 120 organizations across industries and countries, using Microsoft Planner-style notifications about HR, payroll, and benefits updates as lures. Victims were directed to a real `login.microsoftonline.com` authorization page and asked to approve a malicious OAuth application, after which Microsoft redirected the browser to an attacker-controlled AWS API Gateway endpoint that captured an authorization token for exchange into Microsoft account access. Researchers said the technique could give attackers broad access to Microsoft 365 data depending on granted permissions, including email, files, Teams chats, SharePoint, OneDrive, and calendar content, creating risks of credential theft, account takeover, data breaches, financial fraud, malware delivery, and BEC. High-value and privileged users, organizations handling sensitive data, tenants using Microsoft ADFS, and general Microsoft 365 users were identified as potential targets. Recommended defenses include enforcing MFA, auditing Microsoft 365 tenant and OAuth application settings, strengthening email and application security controls, applying sign-in risk policies, and training users to scrutinize consent prompts as well as phishing lures.
Aug 11, 2026