Malicious inbox rule after risky device-code sign-in (hide+external forward)

Arnold Chan@slaz

•updated Sep 23, 2026•0•0•4

Detects the creation of an email inbox rule that includes both a concealment/deletion action and an external forwarding destination, occurring within 4 hours of a high-risk or compromised device-code authentication event. This pattern is indicative of account takeover where an attacker establishes persistence and exfiltration while hiding their activity.