Hackers Hide Alerts With Sneaky Inbox Rules

Cybercriminals are leveraging a common email feature—inbox rules—to maintain persistent access and exfiltrate data undetected. These automated instructions, normally used for organization, are being exploited by attackers to silently manage email flow. They can delete, hide, forward, or mark messages as read, effectively bypassing victim awareness.

Analysis from Q4 2025 revealed that about 10% of compromised accounts had malicious rules created very shortly after initial access. In some instances, these rules were established within five seconds, highlighting their critical importance to attackers. This technique is particularly concerning as it allows attackers to retain access even if the victim changes their password.

Detecting these malicious rules is relatively simple, as they require a name. Attackers often use simple names like '.', '...', or ','. The report identified enterprise users, especially in finance and executive roles, along with university accounts, as prime targets for these Business Email Compromise (BEC) scenarios.