Post by @fifonetworks@infosec.exchange

2026-06-25 15:13 UTC

“Bob, one of my employees can send email from his iPhone, but he’s not receiving any emails.” Well, that’s backwards – usually I see problems the other way around; they can receive, but not send. I tried working with him on a phone call yesterday morning, but when you can’t see the screen, tech support is more difficult. The client’s main business location is in a town less than an hour from my office, so I went to their location after lunch to work on it in person. Oh, so many details were left out! It turned out that he wasn’t receiving emails on his iPhone, his iPad, or his laptop – but he could send from the phone and the laptop. And... the problem started in March, and was continuous from then until now! Okay. First things first. Let’s log into Outlook on the web and see whether that works. I’m starting to have a hunch that I’ve seen this problem before, with other clients. Outlook on the web looks the same. So I went into the Rules settings, and there was the culprit. The rule was named “....” That’s it, the only rule, and the rule name was just four dots. I clicked the drop-down arrow to expand the rule. And the rule said, on incoming mail, move it to the Deleted Items folder and mark it as read! So he was receiving email all along, he just didn’t know it. I looked in the Deleted Items folder, and there were more than 1,300 messages, including my two test emails from earlier in the day. I moved everything back to the Inbox. Here’s what happened. In March someone had started sending email pretending to be this employee. He changed his email password, and the outbound spam stopped. That’s all the company did. They thought the problem was solved. Well, that locked the cybercriminal out, but it didn’t delete the rule that the cybercriminal had created to cover their activity. That rule didn’t get deleted until yesterday, June 24. THE LESSON If you believe your email has been compromised, after securing your account, log into each device, and especially the web instance, and look for rules you didn’t create. If a device was compromised, the malicious rule may be in Outlook’s rules on the device. This scenario can also happen in other email apps, like Thunderbird, and in other web-based email accounts, like Gmail. Whether it’s web-based or app-based, look for rules or filters that you were unaware of, and delete them. #CallMeIfYouNeedMe #FIFONetworks #email #TechSupport #HelpDesk Cybersecurity - Networks - Wireless – Telecom – VoIP

Replies (9)

@stiiin@infosec.space 2026-06-27 06:35

@fifonetworks@infosec.exchange Is there a way to backup/restore all settings related to a mailbox? Or to get an audit trail of changes to the settings?

Open ##3421837
@kris@whereismysupersuit.com 2026-06-26 12:46

@fifonetworks@infosec.exchange I see this all of the time especially on Office 365. I thought MFA was supposed to stop this but obviously not. My open question is why does Microsoft push MFA so hard when it obviously does not work? Why are they not posting that people have bypassed this in real attacks?

Open ##3425917
@evan@cosocial.ca 2026-06-26 12:13

@fifonetworks@infosec.exchange this is good advice! #email #infosec

Open ##5365845
@fazalmajid@social.vivaldi.net 2026-06-26 12:16

@fifonetworks@infosec.exchange have a look at the GL.iNet Comet Q for remote debugging of mobile devices.

Open ##5365846
@ryanl@twit.social 2026-06-26 12:54

@fifonetworks@infosec.exchange It isn’t feasible in larger orgs. But at mine I do a quarterly rule check looking for oddball rules. We just had a user experience something similar but found the rule as part of a regular review of the audit trail and mailbox as part of the default post breach actions. The Poweshell script is pretty simple to look for mailbox rules across the org.

Open ##5365847
@smsm1@mastodon.green 2026-06-26 12:56

@fifonetworks@infosec.exchange I've seen a friend have a variation of that where the incoming emails were forwarded to the hacker's address. Luckily I was able to spot it and let them know by phone.

Open ##5365848
@Spark@social.makerforums.info 2026-06-26 19:44

@fifonetworks@infosec.exchange @Maker_of_Things@cupoftea.social That exact same thing happened last week to my neighbor. They ordered a bunch of stuff with her PayPal and also tried to get a multisim to catch her SMS authentications.

Open ##5365850
@Kehvarl@furry.engineer 2026-06-27 06:45

@fifonetworks@infosec.exchange Good point on the web interface. I found out last month that the outlook desktop app won't show you the rules created on the web. It _might_ show a message that there are rules it doesn't show you.

Open ##5365851
@oaks@mastodon.social 2026-06-27 16:10

@fifonetworks@infosec.exchange important to look for apps, too. on compromised office365 accounts hackers often install them for persistence!

Open ##5365852