Business Email Compromise
| Attack type | Business email compromise, account takeover |
| Threat actors | Payroll and invoice fraud crews, including Storm-2755 |
| Coverage since | 2021; hidden inbox rules added October 20, 2026 |
| Platforms | Microsoft 365 |
The money moves by email. Business email compromise ends with a changed direct deposit, a new bank account on a vendor invoice, a wire to the wrong place. Before that, the attacker has to live in a mailbox without being noticed — and that leaves tracks in the Microsoft 365 audit log.
The threat
Once an attacker controls a mailbox — through a stolen session, a phished password or a consented app — the same few moves come next:
- Forward the mail out. A forwarding address sends every message to the attacker, even after they lose access.
- Hide the replies. An inbox rule moves or deletes anything that would give the game away — the bank's confirmation, the colleague asking "did you really change your account?". Attackers name these rules with a single character or a row of punctuation so they don't stand out.
- Borrow someone else's mailbox. Delegated access or Send As permission lets the attacker read and send as a payroll or finance mailbox.
- Get an app to do it. A user or administrator is tricked into consenting to an app that then reads mail on its own.
How Fluency catches it
Fluency flags each of these mailbox changes as it happens — and because Fluency's risk scoring groups behaviors by user, a forwarding address set right after a sign-in lands in the same case as that sign-in. Those combinations are the textbook persistence steps of business email compromise, and far rarer than ordinary sign-in noise, so they rise to the top of the queue instead of drowning in it.
Detections included
| Detection | What it catches |
|---|---|
Office365_InboxRule_Odd_Name | An inbox rule created or renamed with a name made only of punctuation or a single character. High. New in October 2026. |
O365_Exchange_New-InboxRule | A new inbox rule. |
O365_Exchange_SetMailBox_ForwardingSmtpAddress | A mailbox set to forward to an address outside the user's own domain. |
O365_Exchange_Add-MailboxPermission | Access to a mailbox granted to another user. |
O365_Exchange_RecipientPermission_SendAs | Send As permission granted on a mailbox. |
O365_AzureAD_Consent_To_Application | A user consenting to an application. |
O365_AzureAD_Consent_To_Application_Admin | An administrator consenting to an application for the whole organization. |
MITRE ATT&CK
| Tactic | Technique |
|---|---|
| Defense Evasion | T1564.008 Hide Artifacts: Email Hiding Rules |
| Collection | T1114.003 Email Collection: Email Forwarding Rule |
| Persistence | T1098.002 Additional Email Delegate Permissions |
| Credential Access | T1528 Steal Application Access Token |
Get this coverage
The detections are on every Fluency instance and need the Microsoft 365 audit log, collected through the Office365 Audit API.
Not a customer yet? Start a free trial or book a demo.
Related
- Storm-2755: AiTM session theft — the session theft that so often comes first.
- MFA fatigue and password attacks — the other way into the mailbox.