Anatomy of a Phishing-to-BEC Campaign: What One Inbox Rule Revealed

Last week, BitLyft's SOC identified and contained a multi-account phishing campaign that escalated into classic business email compromise (BEC) evasion behavior. The pattern was consistent, the timing was tight, and one detection signal made all the difference. Here is what we saw and what it means for your own defenses.

The Attack Chain

Every compromised mailbox in this campaign followed the same four steps.

First, credentials were harvested through phishing. The sessions that followed authenticated cleanly, with no MFA bypass evidence needed, because MFA was never triggered in the first place.

Second, the attacker logged in from unfamiliar foreign infrastructure. Third, and most tellingly, a "hide the evidence" inbox rule appeared within minutes. It was built to delete incoming mail outright or quietly move it to Junk, with rule processing stopped so nothing else could intervene. That meant the victim never saw a password reset confirmation, a security alert, or a warning from a coworker.

Fourth, the now-quiet mailbox was put to work. It sent phishing internally, reusing a small set of lure subject lines against a shared target list.

Why This Matters Beyond This Campaign

The end goal here was propagation rather than wire fraud, but that distinction matters less than it might seem. The inbox-rule step is identical to what shows up in financial BEC cases. Any organization that can catch this pattern early is catching the same signal that precedes fraud, not just spam.

The timing also lines up with a broader story. Security researchers have been tracking a large-scale password-spraying campaign against Microsoft Azure CLI that abuses a deprecated OAuth flow. That flow only requires a username and password, and it can succeed without ever prompting for MFA if Conditional Access policies were not explicitly written to cover it. Organizations that believe they are fully covered by MFA may still have this gap.

The Signal That Mattered Most

Across every account in this campaign, one indicator stood out above all the noise: a newly created inbox rule, with a short and meaningless name, set to delete or junk incoming mail while stopping all other rule processing, appearing within minutes of a sign-in from unfamiliar foreign infrastructure.

That correlation, a rule creation event tied tightly to a foreign authentication, is cheap to detect and hard for attackers to avoid. If your monitoring is not already alerting on that pattern, it is one of the highest-value additions you can make.

What This Means for Your Defenses

A few practices consistently determine how fast an organization recovers from this kind of compromise.

Reset the password, but also revoke the sessions and refresh tokens tied to it. A password reset alone does not invalidate an active OAuth token, so the attacker can stay logged in even after the credential changes.

Treat the malicious rule as part of containment, not a cleanup step for later. Until it is removed, it keeps suppressing legitimate alerts, including your own remediation notices.

Review your Conditional Access coverage for legacy authentication flows, especially ROPC. A policy scoped to browser-based sign-ins can leave CLI-based logins uncovered even when MFA looks fully enforced on paper.

Finally, know your sign-in log retention window before an incident forces you to find out. Extended history beyond the default window sometimes requires additional configuration, and that is not something you want to discover mid-investigation.

How BitLyft AIR® Fits In

This is the kind of pattern that gets missed when authentication logs and mailbox activity are reviewed separately. BitLyft AIR® correlates identity and mailbox signals together, so a rule creation event and a foreign sign-in are treated as one story instead of two disconnected alerts. That correlation gives analysts a high-confidence starting point instead of a pile of low-context noise, and it supports full containment, from session revocation to rule removal, instead of a partial fix that leaves the door open.

Inbox rule creation immediately following an unfamiliar authentication is one of the highest-value, lowest-noise signals available for catching BEC-style compromise early. It is worth alerting on regardless of how prepared you think you already are.