Inboxfuscation Tool Bypasses Exchange Inbox Rules and Evades Detection

Advanced persistent threat actors are increasingly targeting Microsoft Exchange inbox rules to maintain persistence and siphon data without triggering alarms, according to gbHackers. The newly released Inboxfuscation tool delivers a Unicode-based obfuscation framework capable of generating malicious inbox rules that slip past conventional monitoring solutions.

By exploiting Exchange’s handling of diverse Unicode character sets, Inboxfuscation crafts visually deceptive rule definitions and uses hidden characters and bidirectional controls to cloak malicious behaviours from both human operators and automated scanners.

The framework categorises obfuscation methods into four techniques—character substitution with mathematical alphanumeric symbols, zero-width injection, bidirectional text controls, and hybrid combinations—transforming rule conditions so they appear benign yet execute against mailbox content. While these techniques have not been observed in active campaigns to date, the article notes hypothetical attack models, including a rule named “Executive Communications Archive” that could exfiltrate data.

Inboxfuscation also describes how it assists detection by processing Exchange export logs, SIEM-integrated audit records, and Graph API events to reconstruct rule creation sequences and compute risk scores, with outputs suitable for SIEM ingestion.