# Thwarting Financial Fraud

Attacker logged into a compromised Microsoft 365 account, created hidden inbox rules forwarding vendor finance emails, and diverted invoice payments to attacker-controlled bank accounts.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft
- Analysis by: Huntress
- Disclosed: 2023-07-13
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/thwarting-financial-fraud-shutting-down-hackers-in-microsoft-365
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-thwarting-financial-fraud-shutting-down-hackers-in-microsoft-365
- Tags: area:cloud domain:cloud impact:funds-loss impact:integrity kind:incident platform:threat-intel sev:high tech:email technique:recon vuln:account-takeover vuln:business-logic

**Target:** Microsoft 365 mailbox (Outlook inbox rules)
**Root cause:** Compromised valid cloud account credentials allowed the attacker to create inbox rules that moved vendor finance emails into the rarely-viewed Conversation History folder and marked them read, hiding invoice traffic from the victim.
**Steps:**
1. Attacker obtains valid credentials for the Microsoft 365 account and logs in from `102.88.63[.]112` (Kaduna, Nigeria).
2. Attacker creates `New-InboxRule` named `jkhjg` from a Florida-located session tied to Nigerian IP `102.129.153[.]110`.
3. Attacker creates another `New-InboxRule` named `m,bvc` from the same Nigerian session.
4. Rules forward emails for key employees at the vendors, particularly those involved with finance and operations, at four companies (US logistics firm, clothing brand, Swiss and Chinese logistics companies) into the Conversation History folder with Mark as Read set True.
5. Attacker manipulates or replaces legitimate vendor invoices so the victim pays attacker-controlled bank details.
**How found:** Huntress SOC was alerted to a suspicious login from a Nigerian IP; tracing the user's activity revealed inbox rule creation and forwarding behavior that confirmed malicious intent.
**Exploitation:** With access to the mailbox, the attacker monitored vendor/AP email threads, hid legitimate invoices by moving them to Conversation History and marking them read, then spoofed or replaced invoices so the victim transferred funds to attacker-controlled accounts.
**Escalation:** Rules targeted finance and operations staff across four vendor companies, widening the fraud surface beyond the single compromised mailbox.
**Insight:** Inbox rules that move mail to the Conversation History folder (normally Teams-only, rarely browsed) combined with short keyboard-walk rule names and Mark as Read=True are strong BEC indicators worth hunting for in M365 audit logs.