Microsoft 365 Inbox-Rule Attacks: A Response Guide for Bryan–College Station Businesses

Dane Gray

Nov 2

5 min read

Updated: Nov 4

Most email break-ins don't look like break-ins. Nobody changes your password or locks you out. Instead, the attacker signs in quietly and adds a rule to your mailbox: move anything with "invoice," "payment" or "wire" to an obscure folder, mark it as read, or send a copy to an outside address. You keep working. They keep reading.

For a Bryan–College Station business that bills customers, pays vendors, or handles deposits by email, that one rule is how a routine invoice turns into a payment sent to the wrong account. This guide covers how these attacks work, the signs to watch for, what to do in the first hour, and how to make sure it doesn't happen again.

What is an inbox-rule attack?

An inbox rule is a normal Outlook feature. People use rules to file newsletters or flag messages from their boss. Attackers use the same feature to hide what they're doing.

Once someone has stolen a sign-in (often through a fake Microsoft 365 login page or a stolen session), a rule lets them:

Some of those fake login pages arrive through a printed code. See our guide to QR code phishing.

Hide replies. Messages from your customer or vendor go straight to Archive, RSS Feeds or Deleted Items, so you never see "Did you change your bank?"
Watch the money conversation. A forward rule copies anything about invoices or payments to an outside address.
Stay hidden. Rules keep working after the attacker logs out, and in many cases even after a password reset.

We wrote a step-by-step checklist for finding these rules in Is Someone Forwarding Our Email? Check Microsoft 365. This post is about what comes next: what it means for a local business, and how to respond.

Why Brazos Valley businesses are a good target

Attackers don't pick Bryan or College Station on a map. They pick businesses where email and money move together, and the Brazos Valley has plenty of those:

Construction, trades and real estate with large progress payments, title work and closing funds.
Medical, dental and professional offices that bill insurers, patients and clients by email.
Vendors and contractors that serve the university, hospitals and local government, where purchase orders and invoices follow a predictable pattern that's easy to copy.
Ag, energy and family businesses with long-standing vendor relationships, where nobody thinks twice about an email from someone they've worked with for years.

Busy seasons make it easier. When the office is short-staffed, at the start of a semester or on a home-game weekend, a "quick update to our banking details" is less likely to get a second look.

Warning signs that someone set up a rule in your mailbox

A customer says they replied, but you never saw the reply.
Messages you didn't read are already marked as read.
Emails turn up in Archive, RSS Feeds, Conversation History or Deleted Items without explanation.
A vendor or customer asks about a bank change you never made.
Microsoft 365 shows sign-ins from places or devices your team doesn't use.
People outside the company get odd emails "from" you.

Any one of these is worth a check. Two or more together should be treated as an incident.

What to do in the first hour

Don't reply to the suspicious thread or call the number in it. Use a phone number you already have on file.
Tell your IT provider right away. The sooner sign-ins are reviewed, the more you can learn about what was seen.
End all active sessions, not just the password. A password reset alone may not log out a stolen session. Sign-ins should be revoked and multifactor sign-in re-registered. Our post on why a password reset isn't enough after a stolen session explains why.
Remove the rule, and look for others. Check inbox rules, mailbox forwarding, connected apps and any new sign-in methods the attacker may have added.
Call your bank if money moved. Ask about a recall of the payment and follow their instructions.
Warn the people who were emailed. Customers and vendors on affected threads should know not to trust recent payment instructions until they confirm by phone.
Write it down. Note what happened and when. Texas law has notice requirements when certain personal information is exposed, and your insurer will want a timeline too.

How to stop inbox-rule attacks before they start

Block automatic forwarding to outside addresses for everyone, and allow it only for specific, approved cases.
Use phishing-resistant sign-in where you can, such as passkeys or security keys, so a fake login page can't capture what an attacker needs. See device code phishing: when MFA isn't enough.
Alert on new inbox rules and forwarding changes. Microsoft 365 can raise alerts when a rule moves, deletes or forwards mail. Someone needs to look at those alerts, every day.
Watch identities around the clock. Identity threat detection and response looks for risky sign-ins, unusual locations and suspicious mailbox changes, with security analysts reviewing alerts 24/7. Learn more about ITDR from 24uNet.
Set a callback rule for money. Any change to bank details gets a phone call to a number already on file, never the number in the email. Our post on stopping wire fraud before the money moves walks through the habit.
Train staff on what this looks like. People who know that hidden replies and "new bank" emails go together will speak up sooner.

These controls are part of our Security Baseline, the standard setup we put in place for every client.

Local help in Bryan–College Station

24uNet supports businesses across Bryan, College Station and the Brazos Valley. If you've seen any of the warning signs above, or you just want to know whether anyone has set rules in your company's mailboxes, we can check every mailbox and walk you through what we find. Learn more about our cybersecurity and IT support in Bryan–College Station, or contact us to book a mailbox review.

FAQ

What is a malicious inbox rule in Microsoft 365?

It's an Outlook rule created by an attacker after they get into a mailbox. It usually hides, deletes or forwards messages about invoices and payments so the attacker can watch the conversation and step in without the owner noticing.

Does changing my password remove an inbox rule?

No. Rules stay in the mailbox until someone deletes them, and a password change may not end a stolen session. Revoke sessions, remove the rule and check for other changes.

How do I check my mailbox for hidden rules?

In Outlook, open Settings and look at Rules and Forwarding. Our step-by-step checklist shows exactly where to look and what a suspicious rule looks like.

Should we block external email forwarding?

For most small businesses, yes. Block automatic forwarding to outside addresses by default and allow it only where there's an approved business reason.

Can 24uNet check our mailboxes in Bryan–College Station?

Yes. We review rules, forwarding and sign-in activity across every mailbox and help local businesses close the gaps.