Malicious Gmail forwarding rules: the persistence that survives a password change
By the QuantumSec team
When an attacker compromises a Gmail account, one of their first actions is to create a forwarding rule or a filter that sends them a copy of the email and hides the alerts. These rules persist even if you change the password, and they're one of the most overlooked indicators of compromise.
How attackers use forwarding rules
An automatic forwarding rule sends a silent copy of all incoming email to an external address controlled by the attacker. It lets them monitor the account for weeks —especially useful for CEO fraud (BEC)— without having to sign in again, which reduces the risk of being detected.
Filters that hide the trail
Besides forwarding, the attacker often creates filters that automatically archive or delete security alerts, victims' replies or emails that could expose the fraud. This keeps the operation hidden from both the user and the security team.
Why they survive a password change
Forwarding rules and filters are account configuration, not session state. Changing the password closes active sessions, but doesn't remove the rules: the email keeps being forwarded. That's why, after an incident, you must review and remove them explicitly.
How to detect and prevent them
At the organization level you can disable automatic forwarding to external addresses and configure alerts. As part of the security routine and incident response, periodically review the forwarding rules and filters of accounts, especially the highest-value ones.
FAQ
Can I prevent automatic forwarding to external addresses?
Yes. From the admin console you can disable or restrict automatic email forwarding to external addresses at the organization level. It's one of the most effective measures to cut this persistence vector.
After an incident, what should I review in Gmail?
Forwarding rules, filters, mailbox delegation, app passwords and active sessions. Any of them can keep the attacker's access even after you've changed the password.