Select Page

There have been a couple email accounts where emails are going to the RSS Feeds folder instead of the Inbox. This is different to the previous post on this issue.

It took a while to figure out that this was what was happening. The symptom was that emails were no longer being received to the Inbox. Microsoft shows them delivered, but they would not turn up in the Inbox.

This change occurred right after the mailbox was compromised and was used to send out Spam. The email password was changed and the mailbox brought under control, but email was not flowing as expected.

Solution

We checked rules on the Microsoft 365 server. We checked the email address flow and it showed emails were being delivered. So if email shows as delivered why was it not in the Inbox?

We checked email Quarantine and did see some activity there due to the sending of the Spam.

We finally discovered that on the email account settings at https://outlook.office365.com a rule had been added that moved all incoming emails to the RSS Feeds folder.

Go to the account online, go to settings, all setting, Mail and check Rules.

It would appear that as part of the attack against this email account a new rule for all incoming mail to be moved to the RSS Feeds folder was part of it. We are not sure if this RSS feed was being monitored, but simply turning off and removing the rule resolved the issue.

The email account then had to be reviewed to move emails from the RSS Feeds Folder back to the Inbox, and testing showed that emails now arrived in the Inbox as expected.