BEC Attackers Argue Inside Inbox Rule Names, Coalition Finds
Image
Global – October 17, 2026 -- Coalition Incident Response (CIR) has documented rival Business Email Compromise (BEC) attackers using the names of inbox rules as a chat channel inside the same compromised mailbox, and says the exchanges expose gaps in default email platform security.
Two intruders negotiate and fight through rule names
Abusing inbox rules to evade detection (MITRE ATT&CK T1564.008) is a widespread tactic. Attackers use it to hide, redirect or forward emails containing keywords such as "invoice" or "confidential." In one CIR investigation, an attacker aware of a second intruder appeared willing to cooperate so that neither ruined the payout. In another incident, two actors fought over an inbox in a prolonged argument recorded as a sequence of rule names.