How do Email accounts get compromised in a script-like fashion?

Hey everyone, I work in IT like I'm sure many of you on here do and see customers emails getting compromised in the same script-like fashion. What I mean by this is it doesn't appear like someone has manually gained access to the account and run a script but instead seems like some attachment might have had some sort of embedded script. All I know is whatever it is creates rules for forwarding and or deleting emails as soon as …

access account accounts compromised customers cybersecurity email emails fashion hey run script work