Changing your password does not remove a mail rule. If an attacker added one, it keeps forwarding or hiding your mail afterwards, which is exactly why they add rules in the first place. Here is where to look — there are three separate places, not one — and what to do before you delete anything.
| Symptom | Likely cause | Safe first step | When to call |
|---|---|---|---|
| A rule you did not create, named with a dot or blank | Attacker persistence after mailbox access | Screenshot it, then delete and revoke sessions | Same day — assume the account was reached |
| Mail forwards to an unfamiliar external address | Exfiltration rule or forwarding setting | Capture the address, remove it, reset from a clean device | Immediately, especially if invoices pass through |
| Vendor says they replied and you never saw it | Rule hiding replies in an unused folder | Check RSS Feeds, Archive and Conversation History | Before paying anything that was in that thread |
| Password was reset but odd activity continues | A rule, an app consent or a live token still in place | Sign out all sessions and audit connected apps | Now — a reset alone did not close it |
A rule outlives the intrusion. It keeps working after you change your password, it hides the replies to the fraud they are running in your name, and it does not look like malware to anything scanning your machine. The classic pattern: a rule quietly moves anything containing invoice, payment, wire or bank into a folder nobody opens, so the real vendor's confused replies never reach you while the attacker redirects a payment.
Checking only the Outlook desktop app is the usual mistake:
They are deliberately forgettable. Names are a single character, a dot, a comma, or blank. The action forwards to an outside address — often a free gmail or outlook address one letter off a real contact — or moves mail into RSS Feeds, Conversation History, Archive, Notes or Deleted Items, folders chosen because nobody looks in them. Some also delete the server copy after forwarding, so the only trace is the rule itself. That is why you screenshot before you delete.
Removing the rule stops the leak; it does not end the access. Sign out all sessions and revoke refresh tokens, because a stolen token survives a password change. Re-enroll multi-factor authentication rather than assuming it held. Review connected and enterprise applications that were granted consent — an approved app is access without a password. Then check email authentication: SPF, DKIM and DMARC records make look-alike spoofing of your domain harder, and attackers who have been in your mail often come back from outside it. Audit logs in Microsoft 365 default to a limited retention window, so pull the evidence early.
Preserve sign-in and audit logs first, then remove malicious rules and forwarding, revoke sessions, review app consents, re-enroll MFA, and check SPF, DKIM and DMARC. You get a written timeline of what was accessed and when. That document is what your insurer, bank and attorney will ask for, and it is also what tells you honestly whether client data was exposed — a question worth answering accurately rather than optimistically.
The full compromise response for Microsoft 365 and Google Workspace.
Invoice fraud, changed bank details and wire recovery steps.
Local response with on-site follow-up.
Local response for Atascocita, Humble and Lake Houston.
A battle-tested 5-step methodology that gets your business back online — fast, clean, and fortified.
Isolate infected systems, cut ransomware's lateral movement, and prevent further encryption of your data.
Identify the ransomware variant, remove all malicious code, and document the attack vector for your records.
Recover your files from clean, verified backups — no ransom payment needed. We validate data integrity at every step.
Rebuild affected systems with enhanced security configurations, patched vulnerabilities, and updated defenses.
Comprehensive security assessment, detailed forensic report, and a custom prevention plan to stop future attacks.
Straight answers before you spend a dollar. If your case needs someone else, we say so and help you escalate.
Operating disclosure: Virus Pros is the malware and ransomware specialty service of Atascocita IT Services, the local IT brand serving Kingwood, Atascocita, Humble and the wider Northeast Houston territory. Work is delivered by the same local technicians under that company.
Local experts who know your community. On-site response available throughout the greater Northeast Houston area.
Calls are answered 24/7 and screened, so urgent cases reach a technician fast.