We are not sure if this RSS feed was being monitored, but simply turning off and removing the rule resolved the issue. It would appear that as part of the attack against this email account a new rule for all incoming mail to be moved to the RSS Feeds folder was part of it. Go to the account online, go to settings, all setting, Mail and check Rules. We finally discovered that on the email account settings at a rule had been added that moved all incoming emails to the RSS Feeds folder. We checked email Quarantine and did see some activity there due to the sending of the Spam.
So if email shows as delivered why was it not in the Inbox? We checked the email address flow and it showed emails were being delivered. We checked rules on the Microsoft 365 server. The email password was changed and the mailbox brought under control, but email was not flowing as expected. This change occurred right after the mailbox was compromised and was used to send out Spam. Microsoft shows them delivered, but they would not turn up in the Inbox. The symptom was that emails were no longer being received to the Inbox.
It took a while to figure out that this was what was happening. This is different to the previous post on this issue. Turns out this is because emails are going to the RSS Feeds folder instead of the Inbox. Emails are being delivered to the email account but do not show up in the Inbox folder.
0 kommentar(er)
