A bit of help on this one if anyonce can, Outlook account (on exchange) seems to have been compromised, however in an automated spam kind of way, a rule is set up on the account to move items from inbox to deleted items, email is sent from the account to other accounts including itself.

An email was recieved into one account with a scam weblink, a user did submit their details however does not result in manual activity more automated.

Any ideas.



This is quite a common occurrence that I've seen elsewhere. I'm pretty sure that it generally occurs when a user has an insufficiently strong password and gets targetted though it may also happen via malware.

The attacker tries to hide what they have done by deleting the sent history.

The users account should be immediately suspended and the server logs used to find out what has been sent. All of the accounts in the users contact list and recent emails may also then get attacked or at least spammed and should also be warned.

Before re-enabling the users account, their password should be changed and their PC scanned for malware (more than just anti-virus) by someone with experience.

Don't forget to also check any other devices with access to the mail account.

I should note that, where I've most seen this is in an industry sector being actively targetted.

  • Hi Julian, thank you for the response it is appreciated, I get the incident response part and follow up action, however I'm trying to understand more how it occurs, it doesnt seem to be 'someone' i.e. a person using the credentials to gain access and manually add rules, delete emails or even send malicious email, it seems to follow a more automated process, I know historically (2014) there was a flaw in Outlook 365 for XSS, i'm trying to find out how (if it is an infection) propogates to exploiting the mail. – Luke Sep 27 '16 at 7:37
  • Due to the complexities of the system we work with and the number of people. I've not been able to track anything specific down. But in general, I'd assume that there are millions of people to use a low-cost labour rather than complex automated attacks. No way to verify though unless you have really good real-time reporting on your AD & Exchange service. You'd probably need to craft a tool for the workstations too. Or maybe an Outlook addin for monitoring. – Julian Knight Sep 27 '16 at 8:47
  • Also, if you have access to your AD, maybe run a check against the passwords in AD - you will doubtless be horrified by the number of poor passwords. – Julian Knight Sep 27 '16 at 8:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.