Malicious Gmail forwarding rules: the persistence that survives a password change
By Kike Gandia · Co-Founder & CEO, OSCP
When an attacker compromises a Gmail account, one of their first actions is to create a forwarding rule or a filter that sends them a copy of the email and hides the alerts. These rules persist even if you change the password, and they're one of the most overlooked indicators of compromise.
How attackers use forwarding rules
An automatic forwarding rule sends a silent copy of all incoming email to an external address controlled by the attacker. It lets them monitor the account for weeks —especially useful for CEO fraud (BEC)— without having to sign in again, which reduces the risk of being detected.
Filters that hide the trail
Besides forwarding, the attacker often creates filters that automatically archive or delete security alerts, victims' replies or emails that could expose the fraud. This keeps the operation hidden from both the user and the security team.
Why they survive a password change
Forwarding rules and filters are account configuration, not session state. Changing the password closes active sessions, but doesn't remove the rules: the email keeps being forwarded. That's why, after an incident, you must review and remove them explicitly.
How to detect and prevent them
At the organization level you can disable automatic forwarding to external addresses and configure alerts. As part of the security routine and incident response, periodically review the forwarding rules and filters of accounts, especially the highest-value ones.
The other mechanisms that survive a password change
The forwarding rule is the best known, but it is not the only setting an attacker leaves behind. In incident response you have to review the whole family.
Mailbox delegation lets another account read and reply to the mail without knowing the password. App passwords keep working over IMAP or SMTP even after you rotate the main credential and even with 2SV enabled. Verified send-as addresses allow continuing to send mail from the victim’s address from outside the organization. And there is a detail that is almost always missed: the forwarding address stays verified independently of the rule, so deleting the rule without removing the address leaves the path ready to be re-enabled with one click.
On top of that sits the CEO-fraud classic, which grants no access but does sustain the scam: the user’s signature edited with altered bank details.
What to review after a compromise, and where each item lives
This is the list worth walking end to end before calling an account incident closed.
| Mechanism | Where it is visible | Survives a password change? |
|---|---|---|
| Automatic forwarding rules | Gmail settings, forwarding and POP/IMAP section | Yes |
| Filters that archive or delete | Gmail settings, filters section | Yes |
| Verified forwarding addresses | The same screen, even if the rule is off | Yes |
| Send-as addresses | Gmail settings, accounts section | Yes |
| Mailbox delegation | Account settings and admin console | Yes |
| App passwords | Google account security settings | Yes |
| Third-party OAuth tokens | Admin console, API access | Yes |
| User signature | Gmail settings | Yes |
| Active sessions | Admin console, user security | No, they are closed |
Everything marked yes in the last column is account configuration, not session state, which is why it has to be removed explicitly.
FAQ
Can I prevent automatic forwarding to external addresses?
Yes. From the admin console you can disable or restrict automatic email forwarding to external addresses at the organization level. It's one of the most effective measures to cut this persistence vector.
After an incident, what should I review in Gmail?
Forwarding rules, filters, mailbox delegation, app passwords and active sessions. Any of them can keep the attacker's access even after you've changed the password.
How do I review this across all accounts at once?
The admin console does not offer a global view of each user’s filters and rules, so at scale you go through the API: the Gmail API exposes forwarding addresses and filters per user, and you walk the domain with the Admin SDK. For creation events, the investigation tool lets you search them directly without writing any code.
If I disable external forwarding org-wide, do existing rules disappear?
No. The policy blocks forwarding, but the rule and the verified address can remain configured on the account. If that policy is ever relaxed or an exception is granted, mail flows outward again without anybody having done anything. Rules must be cleaned up explicitly, in addition to applying the policy.
How far back can I look in the logs?
It depends on your Workspace edition and the type of report: Google publishes the retention period and lag for each one. It is worth checking before an incident rather than during: if the period you need to investigate falls outside the retention window, the alternative is exporting logs continuously to your own storage.
Does the user know I am reviewing their filters?
A review performed over the API with admin credentials generates no notification for them. Even so it is worth covering in your internal policy and in what staff are told, so that mailbox review during incident response is already provided for and does not depend on an improvised decision in the middle of an incident.
Related service
Google Workspace security audit
Related content
- How attackers hack a Workspace
- Google Workspace hardening checklist
- Google Workspace security for businesses