When most people picture a hacked email account, they imagine spam going out or a locked-out user. The more dangerous version is quiet. An attacker signs in, creates one small rule, and signs out. From then on, copies of incoming messages flow to an outside address, or certain messages vanish before the real user ever sees them. Nothing looks wrong, which is exactly the point.
In healthcare and senior living, mailboxes hold invoices, resident family communications, vendor details and sometimes protected health information. A hidden rule can expose all of it for weeks or months. Here is what these rules look like, why attackers like them, and how to find and prevent them.
A rule gives an attacker persistence. Even after a password is reset, a rule that forwards mail to an outside address may keep working. Attackers use rules for several reasons:
Silent monitoring. Forwarding copies of incoming mail lets them watch conversations about payments, payroll or vendor changes.
Hiding evidence. Rules can move security alerts, bounce messages or replies from colleagues into obscure folders such as RSS feeds or archive, or mark them as read.
Fraud support. In business email compromise, attackers often delete or hide replies so the victim does not discover a fraudulent payment request.
Reconnaissance. Watching mail helps them learn who approves payments and how requests are phrased.
Rules created by attackers often share traits. Watch for:
Rules that forward or redirect mail to an external address, especially a free email service you do not recognize
Rules with very short or meaningless names, such as a single character or a series of dots
Rules that move messages to unusual folders, such as RSS subscriptions, conversation history or deleted items
Rules that mark messages as read automatically
Rules triggered by keywords such as "invoice," "payment," "wire," "bank" or "password"
Rules created at unusual times or from unfamiliar locations
Also check mailbox settings for forwarding configured outside the rules list, and for delegates or added permissions that the user did not approve.
If you use Microsoft 365 or Google Workspace, administrators can review these settings centrally instead of asking each user to look.
Review inbox rules across mailboxes and flag any that forward externally or delete messages.
List mailboxes with forwarding addresses set, and confirm each has a legitimate business reason.
Review mailbox delegation and permissions changes.
Look for sign-ins from unfamiliar countries or devices, repeated failed attempts followed by a success, and new multi-factor authentication methods added shortly before a rule appeared. Audit logging must be turned on to see this history, so confirm that it is enabled and how long records are kept.
A one-time check helps, but attackers can return. Build a periodic review, perhaps monthly, and set alerts so that creation of a forwarding rule notifies an administrator immediately.
Most organizations have little reason to allow users to automatically forward mail to outside addresses. Both major platforms let administrators restrict it.
Block automatic external forwarding at the tenant or domain level through your mail platform's outbound spam or forwarding policies.
Create exceptions only when needed, tied to a specific business purpose and reviewed periodically.
Alert on rule creation that forwards or deletes mail so that suspicious activity is visible.
Require multi-factor authentication for every user, which prevents many of the takeovers that lead to rule creation in the first place.
Restrict legacy sign-in methods that bypass multi-factor protection.
Test the change with a few users before rolling it out, since some departments may forward mail for legitimate workflows that should be handled another way, such as shared mailboxes.
Do not simply delete the rule and move on. Treat it as an incident:
Reset the password and sign out all active sessions for the account.
Remove the rule, forwarding address and any unauthorized delegates or app connections.
Review sent items and audit logs to understand what the attacker did.
Check what information was in the mailbox, since you may need to assess whether protected health information was exposed under the HIPAA Breach Notification Rule.
Look for other affected accounts and warn staff about phishing.
Consider notifying your cyber insurance carrier and legal counsel, depending on what you find.
Users cannot see most of what an attacker does, but they notice odd symptoms: replies that never arrived, messages marked read that they did not open, or colleagues saying they received something that was never sent. Encourage staff to report these quickly without fear of blame.
UnityCare IT helps healthcare organizations lock down email, including multi-factor authentication, forwarding restrictions and alerts for suspicious rules, and can review existing mailboxes for signs of compromise.
An outsourced IT department with proactive maintenance and one number to call.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172