Inbox rules and forwarding in Exchange Online: the favourite persistence of payment fraud
In a payment fraud, the compromised mailbox is the attacker's observation post. A few rules and a forward are enough to read the conversation and hide the replies from the victim. These mechanisms can be detected — if you know where to look.
The classic scenario
An employee enters their credentials on a fake sign-in page. The attacker signs in, reads ongoing conversations with suppliers, then prepares a fake request to change bank details. To stay hidden, they need two things: to see the replies, and to stop the victim from seeing them. Mailbox rules and forwarding provide both.
The mechanisms abused
- Inbox rules: move to a folder nobody opens (RSS Feeds, Conversation History) or delete any message containing "invoice", "payment" or the supplier's name.
- Mailbox SMTP forwarding (
ForwardingSmtpAddress) to an external address, which users can set themselves. - Mail flow rules (transport rules), if the compromised account holds Exchange admin rights.
- OAuth applications the user consented to with mailbox access, which keep reading it after a password change.
Block external forwarding
The outbound spam filter policy controls automatic forwarding to external recipients. Its default, system-controlled setting now blocks automatic external forwarding; the risk comes from custom policies that re-enabled it "for one need" and sometimes apply far more widely. Remote domains and transport rules can also allow forwarding: all three levels need checking.
A legitimate forwarding need is handled with a named, documented exception, not with a policy open to the whole organization.
Detect what already exists
A few Exchange Online PowerShell commands are enough for the inventory:
Get-Mailbox -ResultSize Unlimited |
Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
Select-Object UserPrincipalName, ForwardingSmtpAddress, ForwardingAddress, DeliverToMailboxAndForward
Get-InboxRule -Mailbox user@contoso.com |
Select-Object Name, Enabled, MoveToFolder, DeleteMessage, ForwardTo, RedirectTo, SubjectOrBodyContainsWords
Warning signs: a rule named with a single character, a move to RSS Feeds, a deletion triggered by financial keywords, a redirect to a consumer mail service.
After an incident
Changing the password is not enough. Full remediation revokes active sessions, removes the rules and forwards the attacker created, withdraws suspicious OAuth consents, checks MFA methods added to the account, then searches the unified audit log for other mailboxes accessed from the same IP addresses. Mailbox auditing, on by default, lets you reconstruct what was read.
What an audit checks
- Outbound spam policies and their automatic forwarding setting.
- Mailboxes with active SMTP forwarding.
- Transport rules that redirect or copy mail externally.
- Applications holding mailbox permissions.