In this guide · 8 sections
- 01Why attackers create inbox rules
- 02What a malicious rule usually looks like
- 03How to check rules and forwarding in Outlook and Gmail
- 04Hidden rules: what admins need to check in Microsoft 365
- 05Removing the rules and locking the attacker out
- 06Block automatic forwarding to outside addresses
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Malicious inbox rules forward your mail outside or move and delete messages (often to RSS Subscriptions or Junk) so you miss replies. Check rules and forwarding in Outlook or Gmail, have an admin search for hidden rules, delete unknown ones and block external auto-forwarding.
Why attackers create inbox rules
A rule lets an attacker stay hidden after they lose interest in logging in. Microsoft's guide to responding to a compromised email account lists these symptoms:
- Rules that automatically forward email to unknown addresses
- Rules that move messages to the Notes, Junk Email or RSS Subscriptions folders
- Recently added external email forwarding on the mailbox
- Suspicious messages in Sent Items or Deleted Items, and missing or deleted email
The pattern in business email compromise is simple. The attacker watches your conversations with a client or supplier, then sends a fake invoice or a "new bank account" message. A rule moves the real party's replies, or anything containing words like "invoice", "payment" or "bank", out of your sight, so you never see the client asking "is this new account correct?". Our guide to business email compromise explains the full scam.
What a malicious rule usually looks like
Rules created by attackers tend to share a few traits:
| Trait | Example | Why |
|---|---|---|
| Odd or blank name | ".", "..", "a" or a random string | Less likely to be noticed in a list |
| Keyword conditions | Subject or body contains invoice, payment, bank, wire | Targets the money conversation |
| Sender conditions | From a specific client or your finance contact | Hides one party's replies |
| Move to an unused folder | RSS Subscriptions, Notes, Archive, Junk | You rarely open these |
| Mark as read or delete | Mark as read, then delete | No unread count to catch your eye |
| Forward or redirect | To a free webmail address | Copies your mail to the attacker |
Microsoft also documents an older attack where a rule starts an application or opens a URL to install malware. It notes that current, patched Outlook clients block this by default, which is one more reason to keep Office updated.
How to check rules and forwarding in Outlook and Gmail
Each user can check their own mailbox in a few minutes. Look at both rules and forwarding.
Outlook on the web or new Outlook
Open Settings, then Mail, then Rules. Read every rule. Then open Mail, Forwarding and check that forwarding is off or points where you expect.
Classic Outlook for Windows
File, Manage Rules & Alerts. Rules created on another device sync from the server, so they appear here too.
Gmail
Settings, See all settings, Filters and Blocked Addresses: read each filter. Then the Forwarding and POP/IMAP tab: check no forwarding address is set.
Also check delegates and connected apps
In Gmail, the Accounts and Import tab, Grant access to your account. In Microsoft 365, ask an admin to check mailbox delegates and app consents.
Look in the hiding places
Open RSS Subscriptions, Archive, Junk and Deleted Items, and search for recent emails from your key clients and suppliers.
Google's Gmail filters help page shows where filters live and how to edit or delete them.
Removing the rules and locking the attacker out
Order matters: removing a rule while the attacker can still sign in just lets them add it back.
Block access first
Disable the account or reset the password, and sign out all sessions (revoke sessions in Microsoft 365, or sign the user out from the Google Admin console).
Remove attacker MFA methods and apps
Delete authenticator apps or phone numbers the user didn't add, and revoke unknown app permissions.
Delete the rules and forwarding
Remove every rule the user doesn't recognise, plus any mailbox forwarding. Take screenshots first: they are evidence.
Turn on MFA
Enforce MFA, preferably an authenticator app or passkey, before the user signs back in.
Warn the people involved
Call clients and suppliers who may have received fake payment instructions, on a number you already have.
If personal data may have been exposed, you may need to assess whether it is a notifiable data breach under the PDPA. Keep the timeline of what you found and when.
Block automatic forwarding to outside addresses
Most small businesses have no legitimate need for staff to auto-forward mail outside the company. Blocking it removes one of the attacker's favourite tools.
- Microsoft 365: Microsoft's page on controlling automatic external forwarding explains the outbound spam policy setting. Set it to Off, Forwarding is disabled, rather than leaving it on Automatic, whose behaviour differs between tenants. Turning it off also disables existing inbox rules and mailbox forwarding to external addresses. Allow exceptions only for specific mailboxes with a custom policy.
- Google Workspace: in the Admin console, Apps, Google Workspace, Gmail, End User Access, clear Allow users to automatically forward incoming email, or limit it to internal addresses, per Google's admin help.
Do it yourself or get help?
Checking your own rules in Outlook or Gmail is quick, and blocking external forwarding is a single setting. The hidden-rule search and full lockout need admin access and some PowerShell comfort, and mistakes leave the attacker a way back in.
Our Hacked Email Recovery (S$290) signs the attacker out everywhere, resets the password, forces MFA, removes hidden forwarding and inbox rules, revokes suspicious app connections, reviews sign-in history and gives you a written timeline for your PDPA breach assessment. To make the next attempt harder, our Email Threat Protection (S$290) tunes Defender for Office 365 or Google Workspace protection, adds impersonation protection for directors and finance staff and rules to catch payment-change scams.
Frequently asked questions
Open your rules in Outlook (Settings, Mail, Rules) or your Gmail filters, and look for ones you didn't create: odd names, conditions on words like invoice or payment, actions that move mail to RSS Subscriptions, Archive or Junk, mark it read, delete it or forward it outside. Also check the forwarding setting. In Microsoft 365, ask an admin to search for hidden rules.
Rules that exist on the mailbox but don't appear in the user's rule list in Outlook. Attackers use them because the user can't see them. Admins can list them in Exchange Online PowerShell with Get-InboxRule and the IncludeHidden switch, which Microsoft's compromised-account guide recommends when investigating a hacked mailbox.
No. Rules and forwarding settings stay on the mailbox after a password change and keep running. You need to delete them separately. Do it after locking the attacker out, by resetting the password, signing out all sessions and removing any MFA methods or apps they added, otherwise they can recreate the rules.
For most small businesses, yes, at least to outside addresses. Auto-forwarding is a common way attackers copy mail from a hacked mailbox. Microsoft 365 and Google Workspace both let admins block it company-wide and allow exceptions for specific accounts, such as an accounts mailbox that forwards bills to your accounting software.
That is a classic sign of a malicious inbox rule. Attackers use folders like RSS Subscriptions, Notes or Archive because people rarely open them. Check your rules for one that targets that client's address or keywords, treat the mailbox as compromised, and call the client to confirm any recent payment instructions.