Malicious Email Forwarding Rules: The Hidden Persistence After Account Takeover

An account takeover is not a single event; it’s the beginning of a silent, prolonged occupation of your digital space. When a cybercriminal gains access to your email account, their first goal is not always immediate, noisy destruction. Instead, the most sophisticated attackers aim for persistence. They want to remain hidden within your account for as long as possible, observing, learning, and waiting for the perfect moment to strike. One of their most effective and insidious tools for achieving this is the manipulation of email rules. A feature designed for convenience becomes a weapon for stealth, allowing them to intercept critical information, suppress warnings, and orchestrate complex fraud schemes without your knowledge. This hidden persistence turns your own inbox into a compromised surveillance tool, working against you long after the initial breach.

This article will delve into the world of malicious email forwarding and filtering rules. We will explore how attackers exploit these simple settings to maintain control, detail the specific types of fraud they enable, and provide a comprehensive guide on how to detect, remove, and recover from this stealthy form of attack. Understanding this threat is the first step toward reclaiming your digital security and protecting your assets from an invisible enemy.

Spis treści:

1. Understanding the Threat: What Are Malicious Email Rules?
2. The Attacker’s Playbook: How and Why They Use These Rules
3. Your Defensive Checklist: How to Detect, Remove, and Recover

Understanding the Threat: What Are Malicious Email Rules?

Email rules, often called filters, are automated actions that your email client performs on incoming messages based on criteria you set. In a legitimate context, they are incredibly useful. You might create a rule to automatically move all emails from a specific sender into a dedicated folder, flag messages with the word “urgent” in the subject line, or forward newsletters to a different email address to keep your primary inbox clean. This functionality is built into every major email platform, from Microsoft 365 and Outlook to Google Workspace and Gmail.

The danger arises when a malicious actor gains access to your account and creates rules for their own benefit. They exploit this trusted, native feature to operate undetected. Because these rules are part of the email platform’s standard functionality, they do not trigger antivirus software or traditional security warnings. The attacker is simply using the tool as it was designed, but for nefarious purposes. This makes malicious rules a highly effective method for achieving long-term persistence within a compromised account.

The Silent Sabotage of Your Inbox

Imagine a spy who can read your mail before you do, throw away the letters they do not want you to see, and make copies of the most important ones without leaving a trace. This is precisely what a malicious email rule does. An attacker can set up a rule that is triggered by specific keywords, senders, or other criteria. Once triggered, the rule can perform a series of actions that serve the attacker’s goals while keeping you completely in the dark. The subtlety is the key. You continue to use your email as normal, unaware that a sophisticated filtering and intelligence-gathering operation is running silently in the background. Your most confidential communications could be siphoned off to an attacker’s server for weeks or even months before you notice anything is wrong. This level of access provides them with invaluable reconnaissance for planning larger attacks. For a deeper dive into proactive defense mechanisms, explore our comprehensive security resources.

More Than Just Forwarding: The Trio of Malicious Rules

While often grouped under the term “forwarding rules,” attackers use a combination of three types of rules to achieve their objectives. Understanding each type is crucial for effective detection.

• Forwarding and Redirection Rules: This is the most direct method of espionage. An attacker creates a rule to automatically forward a copy of specific emails, or even all incoming emails, to an external account they control. For example, a rule might be set to forward any email containing the words “invoice,” “payment,” “password,” or “contract.” You still receive the original email, so nothing appears to be missing from your inbox, but the attacker now has a perfect copy for their own analysis.

• Deletion Rules: These rules are designed for concealment. Their primary purpose is to hide the attacker’s tracks and prevent you from being alerted to the compromise. An attacker will create a rule to instantly and permanently delete any emails from your IT department, security software, or financial institutions that contain phrases like “suspicious login detected,” “security alert,” “password has been changed,” or “unusual activity.” By deleting these warnings before you can see them, the attacker remains invisible and can continue to operate within your account unchallenged.

• Filtering and Moving Rules: This is a more subtle form of sabotage. Instead of deleting sensitive emails, the attacker creates a rule to move them to an obscure or rarely checked folder. Common destinations include the RSS Feeds folder, Junk Email, Notes, or a newly created folder with an innocuous name like “Archive1” or a single dot “.”. The goal is to get the email out of your immediate view. For example, a rule could move all emails from a specific financial partner into the RSS folder. You assume the partner simply has not been in touch, while the attacker is freely reading their communications and planning how to intercept a future transaction.

The Attacker’s Playbook: How and Why They Use These Rules

Creating malicious rules is not random; it is a calculated step in a larger attack chain, most commonly associated with Business Email Compromise (BEC) and other forms of financial fraud. After gaining initial access to an account, often through a phishing attack, the attacker’s objective shifts from access to exploitation. The rules they create are tailored to facilitate this next phase.

The most dangerous threat is the one you never see. Malicious email rules are designed to make the attacker invisible, turning your own inbox against you while they meticulously plan their financial strike. The breach is not the attack; it’s the beachhead.

The Primary Motive: Financial Fraud and Data Exfiltration

The end goal for most attackers using this technique is financial gain. The compromised email account becomes the perfect platform for launching sophisticated fraud schemes. By monitoring communications, the attacker gains deep insight into business operations, financial transactions, and key personnel.

A classic example is invoice fraud. Here is how it unfolds:

1. Reconnaissance: The attacker sets up a rule to forward all emails containing the word “invoice” to their own inbox. They silently observe the flow of communication between your company and its suppliers for several weeks, learning the typical invoice amounts, payment schedules, and communication style.
2. Interception: When a legitimate invoice arrives from a known supplier, their rule forwards a copy to them. They immediately use a corresponding rule to move the original email to a hidden folder or delete it, so the accounts payable department never sees it.
3. Manipulation: The attacker takes the legitimate invoice PDF, alters the bank account details to their own, and saves it with the exact same file name. They may even register a domain that is visually similar to the supplier’s (e.g., “suppliercorp.com” instead of “supplier-corp.com”) to enhance legitimacy.
4. Execution: From your compromised email account, the attacker replies to the original thread or starts a new one, attaching the fraudulent invoice and explaining that “our company has recently updated its banking details.” Because the email comes from a trusted internal account and the context is correct, the accounts payable team is highly likely to process the payment to the attacker’s account.

By the time the real supplier follows up about the missed payment, the money is long gone. This type of attack is incredibly effective and a primary driver behind the billions of dollars lost to BEC scams each year. Protecting against such advanced threats requires a multi-layered security posture.

The Art of Invisibility: Suppressing Alerts and Hiding Tracks

Maintaining access is just as important as gaining it. Attackers are acutely aware that email providers and IT departments send automated alerts for suspicious activity. A rule to auto-delete these warnings is one of the first things they set up after a compromise. Common keywords they target for deletion include:

• “Security alert”
• “Suspicious sign-in”
• “Unusual activity detected”
• “New login from [Location/Device]”
• “Password reset”
• “MFA” or “Multi-Factor Authentication”

By eliminating these notifications, the attacker can operate with impunity. They can log in from different locations, change account settings, and even disable security features without you ever receiving the warning email that would normally be triggered. This creates a dangerous false sense of security, as your inbox appears normal while it is actively being controlled and exploited by an unauthorized party.

Your Defensive Checklist: How to Detect, Remove, and Recover

Discovering a compromised account can be stressful, but a methodical approach can help you regain control and mitigate the damage. Regularly checking for unauthorized rules should be a part of your personal and corporate cybersecurity hygiene. If you suspect a breach, this should be one of your first actions after securing initial access.

A Platform-by-Platform Guide to Rule Inspection

The process for checking rules is slightly different depending on your email provider, but the principles are the same. Look for anything you did not create yourself.

For Microsoft 365 / Outlook (Web Version):

1. Click the Settings gear icon in the top-right corner.
2. Select “View all Outlook settings” at the bottom of the pane.
3. In the new window, go to Mail > Rules.
4. Carefully examine every rule listed. Look for any rules that forward messages to an unknown external email address. Pay close attention to rules that delete messages or move them to unexpected folders. An attacker might give a rule an innocent name like “Cleanup” to avoid suspicion.
5. While in the settings, also check Mail > Sync email to see if any forwarding is enabled at the account level, which is separate from the rules.

For Google Workspace / Gmail:

1. Click the Settings gear icon in the top-right corner.
2. Select “See all settings”.
3. Navigate to the “Filters and Blocked Addresses” tab.
4. Review this list meticulously. Look for any filters that forward to unfamiliar addresses, delete messages, or apply unusual labels. Attackers in Gmail often use filters to “Mark as read” and “Skip the Inbox (Archive it)” to hide emails without outright deleting them.
5. Next, click on the “Forwarding and POP/IMAP” tab. Ensure that forwarding is not enabled to an address you do not recognize. An attacker can set a master forwarding rule here that is not visible in the “Filters” tab.

If you discover a malicious rule, do not just delete it immediately. Take a screenshot first. This can serve as crucial evidence for a forensic investigation or for reporting the incident. After documenting it, delete the rule. If you are a victim of such an attack, professional intervention is often necessary to trace the funds and navigate the recovery process. At Nexus Group, we provide expert assistance to recover assets lost to online fraud. We understand the urgency and stress of these situations. That’s why we offer a clear promise: we guarantee the recovery of your funds, or you receive a full refund on our services. This is our commitment to your financial security. This approach is part of our holistic view on digital security.

After removing the rules, the work is not over. The rules were a symptom of a larger problem: an account compromise. You must now take immediate steps to secure the account and your wider digital ecosystem.

1. Change Your Password: Create a new, strong, and unique password for the email account immediately. Do not reuse a password from any other service.

2. Force Log-out of All Sessions: Most email providers have a security option to “sign out of all other web sessions” or “sign out everywhere.” Use this to revoke the attacker’s active session token.

3. Enable Multi-Factor Authentication (MFA): This is the single most effective step you can take to secure your account. MFA requires a second form of verification (like a code from your phone) in addition to your password, making it exponentially harder for an attacker to regain access.

4. Review Account Recovery Settings: Attackers often change the recovery phone number or email address to one they control, allowing them to reset your password even after you change it. Verify that these settings are correct.

5. Audit Connected Apps and Permissions: Review all third-party applications that have been granted access to your account. Revoke permissions for any app you do not recognize or no longer use.

Malicious email rules represent a significant and often overlooked threat. They are the tool of a patient attacker, one who prefers stealth and strategy over a brute-force attack. By turning a simple productivity feature into a weapon, they can maintain a persistent foothold in your most sensitive digital environment, paving the way for devastating financial fraud. Regular vigilance, including periodic checks of your email rules and filters, is no longer optional—it is a fundamental component of modern digital security. If you have been the victim of a compromise involving these tactics, it is critical to act swiftly and seek professional help to reclaim your assets and secure your accounts against future attacks.

If you suspect your account has been compromised or you have fallen victim to a scam, time is of the essence. Contact us