Vanishing Act: The Secret Weapon Cybercriminals Use in Your Inbox

Modern Email AttacksResearchers at Barracuda describe how attackers use legitimate email inbox rules to control compromised accounts and evade detection.

“In order to create malicious email rules, the attackers need to have compromised a target account, for example, through a successful phishing email or by using stolen credentials seized in an earlier breach,” the researchers write.

“Once the attacker is in control of the victim’s email account – a type of attack known as an account takeover –  they can set one or more automated email rules, a simple process that enables the attackers to maintain stealthy, persistent access to the mailbox – something they can use for a whole variety of malicious purposes.”

Inbox rules can be exploited to carry out further social engineering attacks using the compromised accounts.

“BEC attacks are all about convincing others that an email has come from a legitimate user, in order to defraud the company and its employees, customers, or partners,” the researchers write.

“Attackers could set a rule that deletes all inbound emails from a certain colleague, such as the Chief Finance Officer (CFO). This allows the attackers to pretend to be the CFO, sending colleagues fake emails to convince them to transfer company funds to a bank account controlled by the attackers.”

Barracuda notes that these rules can give attackers access to emails even if they get locked out of the account.

“If the malicious rule isn’t spotted, it stays operational even if the victim's password is changed, they turn on multi-factor authentication, impose other strict conditional access policies, or their computer is completely rebuilt,” the researchers write.

“As long as the rule stays in place, it remains effective. Furthermore, even though suspicious email rules can be a good indication of an attack, just looking at them in isolation may not provide a strong enough signal that an account has been compromised.”

New-school security awareness training can give your organization an essential layer of defense by enabling your employees to thwart social engineering attacks.

Barracuda has the story.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews