Inbox rule abuse is the malicious creation or modification of email filtering rules so messages are hidden, deleted, forwarded, or marked as read without the user noticing. In Microsoft 365 and similar platforms, rules can be made to move mail into folders, auto-archive it, or redirect copies to an attacker-controlled mailbox.
This matters because a compromised mailbox is often more than a place to read messages: it is a control point for business processes. Attackers use inbox rule abuse after phishing, session theft, or password compromise to suppress security alerts, conceal replies, and quietly monitor finance or payroll conversations. That helps them maintain access, avoid detection, and support fraud such as business email compromise.
Defenders look for new or unusual rules, especially ones that reference security keywords, auto-forward external mail, or target payroll and finance messages. Reviewing mailbox audit logs, alerting on rule creation, and enforcing controls that block automatic forwarding can help catch or limit this technique.