Global – October 17, 2026 -- Coalition Incident Response (CIR) has documented rival Business Email Compromise (BEC) attackers using the names of inbox rules as a chat channel inside the same compromised mailbox, and says the exchanges expose gaps in default email platform security.
Two intruders negotiate and fight through rule names
Abusing inbox rules to evade detection (MITRE ATT&CK T1564.008) is a widespread tactic. Attackers use it to hide, redirect or forward emails containing keywords such as "invoice" or "confidential." In one CIR investigation, an attacker aware of a second intruder appeared willing to cooperate so that neither ruined the payout. In another incident, two actors fought over an inbox in a prolonged argument recorded as a sequence of rule names.
Rule names show geography, target research and risk weighing
Heavy use of Nigerian Pidgin ties the activity to West African BEC rings, CIR says, though language alone does not establish location or identity. "Chop this box" means to profit from the inbox.
One attacker noted that wire transfers required CEO approval through an online portal, while ACH transfers needed no administrator approval. CIR says this research time can benefit defenders and shows the value of non-IT controls such as secure payment approval workflows.
The attackers also weighed risk against reward. One warned the other that a "small" $12,000 scam could alert the victim and ruin a much larger payday.
CIR urges Microsoft and other providers to adopt secure-by-default settings
CIR says attackers can create dozens of full-sentence rules that route "invoice" and "wire" emails to the RSS Feeds folder. It calls this a serious gap in default platform security. It adds that Microsoft and other major providers have the telemetry to see the behavior at scale. Its recommendations:
- Disable inbox rules by default, making them opt-in with admin approval.
- Alert on or block sentence-length or nonsensical rule names.
- Trigger high-severity alerts when rules move emails containing "ACH," "Wire" or "Invoice" out of the primary inbox.
- Disable hiding places such as RSS Feeds and Conversation History, and accept routing into them only from approved sources.
- Block external auto-forwarding of corporate mail by default.
Until platforms block these techniques, CIR expects BEC to keep driving cyber claims. It acknowledges that a sweeping change to inbox rule features is unlikely soon.
Wirespeed, whose Automated Detection & Response product acts when suspicious mailbox rules are created, says it resolves 99% of detections in under 754 milliseconds by resetting credentials via API.