Public incident — not a PixelPrivate customer
What happened
- Microsoft Security described a campaign that created rules forwarding mail containing "invoice", "payment" or "statement" to attacker addresses and deleted the originals.
- It used legacy POP3/IMAP and ROPC OAuth flows that bypass MFA prompts.
- Microsoft says it disabled external forwarding by default in Office 365.
- Microsoft Learn lists symptoms of a compromised email account, including "Rules that automatically forward email to unknown addresses" and "Recently added external email forwarding".
Root cause, per the sources
Per Microsoft, account compromise combined with legacy protocols and flows that bypass MFA prompts, followed by forwarding rules that hid payment mail.
The exposure behind it
Once an attacker is in a mailbox, a hidden rule can quietly copy or hide payment mail. Legacy protocols that cannot prompt for MFA widen the gap.
What PixelPrivate can check
Microsoft 365 connector (new)New
Reports external-forwarding rules and payment-hiding inbox rules as indicators for review, such as "External forwarding rule (indicator for review)".
Learn moreWhat PixelPrivate cannot do
- PixelPrivate does not detect intrusions, fraud or active attacks. It performs passive external checks and reports exposures.
- We cannot tell who created a rule or whether it is malicious. A rule is an indicator for you to review.
- We cannot claim that PixelPrivate would have prevented this incident, and we do not claim that.
What to do this week
- Review inbox and forwarding rules on finance and executive mailboxes.
- Block or restrict external forwarding.
- Block legacy authentication.
- Follow Microsoft's guidance if you find a compromised account.
Sources
- Microsoft Security Blog, “Behind the scenes of business email compromise: using cross-domain threat data to disrupt a large BEC infrastructure”, June 14, 2021. https://www.microsoft.com/en-us/security/blog/2021/06/14/behind-the-scenes-of-business-email-compromise-using-cross-domain-threat-data-to-disrupt-a-large-bec-infrastructure/
- Microsoft Learn, “Respond to a compromised email account”, Undated page. https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account
Last reviewed 2026-10-06. Figures are quoted as reported by the cited source.
Related hypothetical scenarios
Questions about this incident
Does a forwarding rule mean an account is compromised?
Not by itself. It is an indicator for review. PixelPrivate cannot tell who created a rule or whether it is malicious.
What did the campaign forward?
Mail containing "invoice", "payment" or "statement", per Microsoft.
Is the connector available?
The Microsoft 365 connector is new.
