HOW HACKERS KEEP ACCESS TO YOUR EMAIL AFTER YOU CHANGE THE PASSWORD

Changing the password is one of the first things to do when someone gets into a business email account. It stops the old password from being used for a new login, but it may not remove other access the attacker set up while they controlled the account.

They may still be signed in through a browser or email app. They could have created a forwarding rule,
connected an outside application, added a recovery method, or given another account permission to use the mailbox.

Until those settings are checked, the attacker may still be able to read messages, receive copies of new email, or
regain access later.

Sign out active sessions

Email services use sessions so you do not have to enter your password whenever you open the inbox. Depending on the provider, a session may continue working until it expires or an administrator revokes it.

Ask your IT provider to revoke the account’s active sessions and sign-in tokens through the email
administration tools. If the employee’s computer may contain malware, start the recovery from another device and have the affected computer checked before anyone signs in again.

Check mailbox rules and forwarding

An attacker can create a rule that forwards incoming email to another address. The rule may send every
message, or it may only target words such as “invoice,” “payment,” or “password reset.” Another rule could hide security alerts or customer replies in a folder the employee rarely opens.

Review forwarding addresses, inbox rules, filters, and automatic replies. Microsoft 365 administrators should also check for hidden inbox rules through the administration tools.

Review connected apps and mailbox access

Scheduling tools, mobile apps, and customer systems can be given permission to use an email account. These connections often work through OAuth, so the application does not need the user’s password.

Remove any connected application the business does not recognize or use. Check mailbox delegates and sending permissions too. Because a delegate signs in through their own account, changing the mailbox
owner’s password does not remove that access.

Check recovery and sign-in methods

Ask the employee to confirm every phone number, recovery email address, authenticator app, passkey, security key, and registered device. Remove anything they cannot identify.

Then review sent, deleted, draft, junk, and archived messages, along with sign-in logs and security alerts. Look for password resets, unusual payment requests, and messages the employee did not send.

If false messages went to customers, suppliers, or employees, contact them through a trusted channel. Tell them which messages were fraudulent and whether they need to ignore a payment request, delete a file, or change a password.

Before the employee signs in again, require multifactor authentication. Use passkeys or physical security keys where the email service supports them.

𝗜𝗠𝗔𝗚𝗘𝗧𝗘𝗫𝗧 𝗜𝗧 𝗦𝗣𝗘𝗖𝗜𝗔𝗟𝗜𝗦𝗧𝗦 

Phone +64 9 623 3102

3 Owens Rd, Epsom, Auckland 1023, New Zealand 

#EmailSecurity #CyberSecurity #SmallBusinessIT #Microsoft365 #MFA
#AppleBusiness #Jamf #DeviceManagement #Imagetext #NZTech #EnterpriseIT #EndpointSecurity #DigitalWorkplace #AppleDeviceManagement #AppleForBusiness #AucklandBusiness #imagetext #EUC