- Proofpoint highlights inbox rules as key persistence tactic in email breaches
- Attackers use rules to hide alerts, forward data, and bypass password changes
- ~10% of compromised accounts in Q4 2025 had malicious rules created within seconds of access
When taking over a person’s inbox, there is one specific, very popular technique cybercriminals use to maintain persistence, exfiltrate data without being spotted, and impersonate their victims - despite it not being malicious on its own, experts have warned.
