The Best Fluffy Pancakes recipe you will fall in love with. Full of tips and tricks to help you make the best pancakes.
CHEAPUNO guide
How to check M365 mailboxes for external forwarding rules
Hijacked accounts often hide external forwarding rules to leak data and spread phishing. Check your logs today.
Cover
Photo: StockSnap (CC0)
What you are probably seeing
Reviewing your Exchange admin center, you notice mail flow rules that redirect messages to addresses outside your domain.
Sign-in logs show successful logins from unusual locations or devices that do not match your team’s standard work patterns.
Why it happens
Attackers compromise credentials to set up hidden forwarding rules that copy mail to an external inbox before the user notices.
These rules persist even after a password reset, allowing continuous data exfiltration and the spread of phishing links to new victims.
What changed recently
2026-10-07 · Update on Nikkei: the phishing sent from its hijacked Microsoft 365 account on Sep 30 claimed at least one victim.
Group publisher Nikkei BP says an employee gave away their login via a phishing emai
Nikkei BP exposed a chain of cloud breaches:
• 9,000 phishing emails from one hijacked box
• Root cause was a late-July Workspace hack
• 1,646 people caught up in the breach
Source: bluesky
Step by step
1. Open the Exchange admin center and list all mailbox forwarding rules to identify any external destinations.
2. Filter sign-in reports for the last 30 days to spot impossible travel or logins from new device types.
3. Review mail flow rules in the M365 admin center to ensure no unauthorized transport agent rules exist.
4. Check audit logs for administrative changes to mailbox properties to find who last modified forwarding settings.
5. Enforce multi-factor authentication on all accounts and review conditional access policies to block legacy authentication.
Ways to go further
Affiliate links: CHEAPUNO may earn a commission if you buy through them, at no extra cost to you.
Other problems readers raise
Does your SSL monitoring catch downtime in seconds?
How to remove your domain from Uceprotect without paying fees?
How to check if your security covers AI attack patterns
How to check if your mobile provider can handle a data breach?
Sources