Mailbox forwarding rules are email settings that automatically redirect incoming messages to another inbox, address, or folder. They are useful for legitimate workflows, such as routing shared mail or archiving messages, but they also create security risk because they can be changed after an account is compromised. An attacker who gains access to a mailbox may create a hidden rule to copy business mail, password resets, invoices, or internal alerts without triggering obvious signs of intrusion.
In cyber attacks, forwarding rules are often used for persistence and stealth. They let intruders monitor communications even after they lose direct access, and they can help them spot opportunities for fraud or deeper compromise. Defenders should regularly review mailbox rules, alert on new or unusual forwarding destinations, and restrict automatic forwarding where possible. Strong authentication and mailbox auditing are important because forwarding abuse may look like normal user activity unless it is actively monitored.