The Inbox That Went Quiet: How an Invisible Email Takeover Actually Works
Most people picture a hacked email account as something you’d notice right away — strange pop-ups, locked screens, an obvious mess. The most dangerous ones are the opposite. They’re quiet. They’re designed so that nothing looks wrong at all.
Here’s a real case we worked recently. We’ve removed every identifying detail to protect the business involved, but the sequence is exactly how it played out — and it’s a story every small-business owner should hear, because it didn’t rely on breaking any technology. It relied on a single click.
It didn’t start with a hack. It started with a forgery.
There was no brute-force attack, no exploited software, no alarm. There was an email.
A busy team member received a message that looked exactly like a routine “review and sign” request — the kind she saw a dozen times a week. She clicked. The page that opened looked like the Microsoft sign-in she’d used a thousand times. She typed her password. Her phone buzzed with the usual approval prompt and, out of pure habit, she tapped Approve.
That was the entire attack. In the background, the fake page was relaying everything in real time and quietly stole her signed-in session. Her multi-factor authentication (MFA) was switched on the whole time. It didn’t help — because she was never asked to defeat it. She was asked to approve it, and she did.
This is the part that surprises people most: modern attacks don’t break your security. They borrow your trust for a single, ordinary moment.
Then the intruder made himself invisible.
The moment the attacker was inside, they didn’t start deleting things or sending obvious spam from the account. They did something much smarter. They created one mailbox rule — named just “..” (two dots), so it would vanish among ordinary settings.
That rule had no conditions, so it applied to everything. Every incoming message was instantly marked as read, swept into a rarely-opened background folder, and hidden from view. The Inbox simply stopped filling up.
With incoming mail hidden, the attacker used the account to send — firing phishing messages to the employee’s contacts under her trusted name. The rule’s real job was to hide the fallout: the bounce-backs and “out of office” replies from that outbound wave landed straight in the hidden folder, so neither she nor her coworkers ever saw a thing.
To everyone in the office, the mailbox looked completely normal. The only symptom she noticed, days later, was silence: “I don’t think I’m getting my email.”
The tell was the silence.
When we examined the mailbox from the server side, the story was unmistakable. New mail was still arriving — but the Inbox had flatlined at one exact moment and never received another message. Everything after that timestamp had been quietly diverted.
Hidden in that background folder, alongside dozens of her real business emails, were the giveaways: a cluster of “Undeliverable” bounce notices and vacation auto-replies — the wreckage of phishing messages the attacker had sent as her, including to legitimate organizations she worked with. The account hadn’t gone quiet on its own. It had been silenced.
Contained in under an hour.
Once we found it, the cleanup was fast:
- We found and removed the hidden rule.
- We restored every diverted email back to her Inbox.
- We signed the attacker out of every session, reset the password, and cleared the MFA registrations.
- We confirmed no mail-forwarding or other hidden persistence remained.
But the real work isn’t the cleanup. It’s making sure it can’t happen in the first place.
The one thing to remember
Every layer of technology in this story worked exactly as designed. The password was strong. MFA was on. Nothing was “broken.” And it still happened — because the attack never targeted the technology. It targeted a person, in an ordinary moment, with a convincing lie.
The single point of failure was the click.
So here’s the habit worth teaching everyone on your team: when an email asks you to sign in, or to “review and sign” a document, don’t click the link. Open your browser and go to the website yourself. That one habit breaks the entire attack chain — before the fake page ever gets a chance.
What actually stops it
A convincing lie will always find its way to a busy inbox. The businesses that don’t get taken down by it have a few things in place:
- Email security that catches the lure before anyone can click it.
- Phishing-resistant sign-in (passkeys or Windows Hello) that can’t be relayed by a fake page — so a stolen password isn’t enough.
- Monitoring for exactly this — rogue inbox rules, impossible-travel logins, and unusual sending — so an invisible takeover doesn’t stay invisible.
- A team that knows the one habit that matters.
Would you know if a mailbox in your business had gone quiet? Most account takeovers are invisible by design — which is exactly why they work. We find them, stop them, and put the protection in place that keeps them out.
Get your free Microsoft 365 security check-up →
Or see our monthly IT & security plans
Frequently asked questions about email account takeovers
What is an email account takeover?
An email account takeover is when an attacker gains access to someone’s email account — usually by tricking them into entering their password and approving a multi-factor prompt on a fake login page — and then reads, sends, or hides mail without the owner’s knowledge.
Can my email be hacked if MFA is turned on?
Yes. Modern “adversary-in-the-middle” phishing relays your login in real time and steals your active session, so approving a normal MFA prompt can still hand the attacker access. Phishing-resistant sign-in such as passkeys or Windows Hello prevents this, because it can’t be relayed by a fake page.
How do I know if my email account has been taken over?
Warning signs include your inbox suddenly going quiet, contacts receiving messages you didn’t send, unexpected “undeliverable” bounce notices, or hidden mailbox rules moving your mail into folders like Conversation History. Monitoring for suspicious sign-ins and new inbox rules is what catches it quickly.
How can a small business prevent an email account takeover?
Use phishing-resistant MFA, require MFA for every user, block legacy authentication and external auto-forwarding, add a managed email-security layer that filters phishing before the click, and monitor for account compromise so a breach is caught in minutes rather than days.
Client details in this story have been anonymized to protect a real business that trusted us to keep them secure.
