ITSEC Newsletter 2025-09-18

Microsoft Exchange inbox rules have emerged as a critical attack vector for advanced persistent threat (APT) groups seeking to establish persistence and facilitate data exfiltration within enterprise environments. Our research introduces Inboxfuscation, a sophisticated Unicode-based obfuscation technique that is able to create malicious inbox rules that evade detection by traditional security monitoring systems.

I learn about cryptographic vulnerabilities all the time, and they generally fill me with some combination of jealousy (“oh, why didn’t I think of that”) or else they impress me with the brilliance of their inventors. But there’s also another class of vulnerabilities: these are the ones that can’t possibly exist in important production software, because there’s no way anyone could still do that in 2025.