Hackers Create Hidden Microsoft 365 Inbox Rules to Conceal Vendor Payment Fraud

Executive Summary

The adversary‑in‑the‑middle (AiTM) phishing kit captured valid Microsoft 365 session tokens, bypassed MFA, and inserted hidden mailbox rules to reroute vendor payments to attacker‑controlled accounts. All Microsoft 365 tenants that permit user‑created inbox rules are exposed, with immediate risk of unauthorized financial transfers. Decision makers must authorize emergency MFA enforcement, audit and purge hidden mailbox rules, and trigger incident response within the next 4 hours.

Verified Facts

• Attackers used an AiTM phishing kit to capture an authenticated Microsoft 365 session token — GBHackers Security.
• The captured token allowed bypass of multi‑factor authentication — GBHackers Security.
• Hidden Microsoft 365 inbox rules were created to conceal redirection of vendor payments to attacker‑controlled bank accounts — GBHackers Security.
• The campaign represents a cloud‑only business email compromise (BEC) without deploying malware — GBHackers Security.

Threat Classification

Threat type: Cloud‑based Business Email Compromise (BEC) leveraging credential theft via an AiTM phishing kit (HIGH CONFIDENCE). Affected sectors: any organization using Microsoft 365 for vendor payments, notably finance, procurement, and professional services (MEDIUM CONFIDENCE). Geographic scope: Global, as Microsoft 365 is a worldwide service (MEDIUM CONFIDENCE). Exploitation status: Active in the wild (HIGH CONFIDENCE). Attacker motivation: Direct financial gain through fraudulent vendor payments (HIGH CONFIDENCE).

Threat Severity Assessment

• Exploitability – attackers only need a successful phishing click to obtain a valid session token (HIGH CONFIDENCE).
• Scope of impact – any Microsoft 365 tenant permitting user‑created inbox rules is vulnerable (MEDIUM CONFIDENCE).
• Prevalence – cloud‑only BEC attacks are increasing, indicating a rising threat surface (MEDIUM CONFIDENCE).
• Potential financial loss – direct diversion of vendor payments can result in multi‑million‑dollar losses per incident (HIGH CONFIDENCE).

Business Impact

Unauthorized diversion of vendor payments can cause immediate cash‑flow disruption, breach of contract, and loss of supplier trust. If personal data of vendors or employees is exposed during the token capture, GDPR penalties could reach up to €20 million or 4 % of global turnover, while NIS2‑compliant entities may face supervisory fines and mandatory breach reporting. Reputational damage includes loss of confidence from partners and investors, potentially depressing market valuation by several percentage points.

Technical Analysis

• Attack vector – adversary‑in‑the‑middle phishing page that harvests the Microsoft 365 authentication cookie (session token).
• Exploitation chain – phishing click → token capture → MFA bypass via token reuse → creation of hidden mailbox rule → automatic forwarding of vendor invoices to attacker‑controlled address.
• Affected components – Azure Active Directory authentication service, Exchange Online mailbox rule engine, Office 365 Management Activity logs.
• Root cause – reliance on session tokens for MFA enforcement and unrestricted user ability to create hidden inbox rules.

MITRE ATT&CK Mapping

• Credential Access → T1110.003: Password Spraying – attackers obtained a valid session token via phishing (article evidence).
• Credential Access → T1550.003: Pass the Ticket – reuse of captured token to authenticate without MFA (article evidence).
• Persistence → T1098.004: Account Manipulation – creation of hidden mailbox rules to maintain access to inbound vendor communications (article evidence).
• Impact → T1566.002: Phishing – Link – the AiTM kit delivered a malicious link to harvest credentials (article evidence).

IOC Intelligence

No public IOCs confirmed at time of publication.

Behavioral IOC categories for detection:

• Creation of mailbox rules with the “hidden” flag set.
• Inbox rules that forward or redirect messages to external, non‑organizational email domains.
• Azure AD sign‑in events showing token reuse without MFA challenge.
• Office 365 Management Activity logs indicating “Set-MailboxFolderPermission” or “New-InboxRule” actions from atypical IP ranges.

Detection Engineering Guidance

• Log source: Azure AD Sign‑in logs – filter for “ConditionalAccessStatus=success” where “AuthenticationDetails” shows “MFA not required” despite policy enforcement.
• Log source: Exchange Online mailbox audit logs – monitor EventID UpdateInboxRule where “Hidden”=true.
• Log source: Office 365 Management Activity – watch for “Set‑InboxRule” or “New‑InboxRule” actions with “RedirectTo” pointing to external domains.
• Telemetry fields: UserPrincipalName, ClientIP, RuleName, ForwardingAddress, IsHidden, AuthenticationMethod.
• Detection rationale: Hidden rules are rarely legitimate and combined with MFA bypass indicate credential theft.

Sigma Rules

title: Creation of Hidden Inbox Rule in Exchange Online
id: 9f8b7c2a-3d4e-4f6a-9b1c-2d5e6f7a8b9c
status: stable
description: Detects creation of a hidden mailbox rule that forwards messages to an external address, indicative of BEC fraud.
author: CYBERDUDEBIVASH Sentinel Apex
logsource:
    product: office365
    service: exchange
detection:
    selection:
        EventSource: "MailboxAudit"
        Operation: "New-InboxRule"
        Parameters:
            Hidden: true
            ForwardTo: "*@*"
    condition: selection
falsepositives:
    - Legitimate admin automation that creates hidden forwarding rules (rare)
level: high
tags:
    - attack.t1098.004
    - attack.t1110.003

Threat Hunting Queries

• Hypothesis: Hidden inbox rules are being used to exfiltrate vendor invoices – Query Exchange Online mailbox audit logs for EventSource=MailboxAudit AND Operation=New‑InboxRule AND Hidden=true AND ForwardTo like ‘%@%’.
• Hypothesis: MFA is being bypassed via token reuse – Query Azure AD sign‑in logs for ConditionalAccessStatus=success AND AuthenticationDetails contains “MFA not required” despite MFA policy.
• Hypothesis: External forwarding to high‑risk domains – Query Office 365 Management Activity for Operation=Set‑InboxRule AND ForwardingAddress ends with “.bank” or known attacker domains.
• Hypothesis: Sudden spike in mailbox rule changes from a single user – Query mailbox audit logs for Count of New‑InboxRule > 5 within 1 hour per UserPrincipalName.
• Hypothesis: Phishing link clicks leading to token capture – Query Azure AD sign‑in logs for UserAgent containing “Microsoft‑Edge/” and Referrer URL matching known phishing landing pages (if threat intel provides URLs).

SOC Analyst Playbook

• P0 – Within 1 hour: Pull Azure AD sign‑in logs for the reported user; if MFA was bypassed, isolate the account and force password reset.
• P0 – Within 1 hour: Search Exchange Online audit for hidden inbox rules; if found, disable the rule and export the rule definition for evidence.
• P1 – 1–4 hours: Review Office 365 Management Activity for any additional forwarding rules created in the past 24 hours across the tenant.
• P1 – 1–4 hours: Block external forwarding domains identified in the rule set at the Exchange transport level.
• P2 – Same day: Initiate vendor payment verification workflow; notify finance and legal teams of potential fraudulent transfers.
• P2 – Same day: Escalate to Incident Response team and begin forensic capture of the compromised session token logs.

Executive Decision Matrix

Executive Recommendations

• Day 1–7: Enforce MFA for all Microsoft 365 sessions, disable token reuse, and immediately remove any hidden inbox rules.
• Day 8–30: Implement a policy that restricts creation of mailbox rules to privileged accounts; deploy continuous monitoring of Azure AD sign‑in and Exchange audit logs using the provided Sigma rule.
• Day 31–90: Conduct organization‑wide phishing awareness training focused on AiTM kits; integrate Sentinel APEX’s real‑time IOC feed and MITRE ATT&CK correlation into the SOC workflow for proactive detection of similar BEC tactics.

MSSP Opportunities

• Prioritize notification to clients in finance, procurement, and any industry with high vendor‑payment volume – these are most exposed to hidden inbox rule abuse.
• Deploy the Sigma rule across all managed Microsoft 365 environments to automatically flag

🔗 Related Intelligence Reports

• Related topic: Hackers Trick AI Agents Into Telling Users to Install the Malware Themselves
• Related topic: Critical Citrix NetScaler Flaw Allows Attackers to Bypass Authentication
• Related topic: Hackers Impersonate Claude, ChatGPT and Copilot to Deliver Infostealers and Backdoors
• Related topic: CVE-2026-60946 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-60947 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record