Phishing and account compromise
Clicked a phishing link or think an account was hacked?
Account compromise is when an attacker gains access to someone’s email or Microsoft 365 account, usually through phishing. Reset the password from a clean device and revoke active sessions, then call our 24/7 incident line at 1-650-300-7557. ACS Cyber helps you lock the attacker out, find out what they accessed and keep the account from being used against your contacts.
01
Reset from a clean device
Change the password from a device you trust, not the one that clicked the link. Use a strong, unique password.
02
Revoke sessions and tokens
Sign the account out everywhere so stolen session tokens stop working. A password change alone may not end an attacker’s session.
03
Check MFA methods
Remove any authenticator app, phone number or security key you do not recognize. Attackers often add their own so they can return.
04
Check rules, forwarding and apps
Look for new inbox rules, external forwarding, delegates and app consents. Record them before you remove them.
05
Check what the account sent
Review sent items for phishing or payment requests sent to your contacts, and warn them by phone or another channel.
- Sign-ins from unfamiliar places
- MFA prompts nobody requested
- New inbox rules or forwarding
- Contacts receiving odd emails from you
- A password that suddenly stops working
Not a client yet? You can still call. If you are unsure how to do these steps safely, call us first.
First steps
Do this now, and what to avoid
These steps apply to most Microsoft 365 and Google Workspace account compromises. If our team or your IT provider advises differently, follow their direction.
| Do this now | Avoid this |
|---|---|
| Reset the password from a clean, trusted device | Resetting only from the device that clicked the link |
| Revoke all sessions and refresh tokens | Assuming a password change has locked the attacker out |
| Review registered MFA methods and remove unknown ones | Approving MFA prompts you did not start |
| Record, then remove, suspicious rules, forwarding and app consents | Deleting evidence before it is documented |
| Warn contacts who received messages from the account | Waiting to see whether anyone reports a problem |
| Have the device that clicked checked for malware | Using that device for sensitive work until it is checked |
How it happens
How attackers get past passwords and MFA
Modern phishing often targets the session, not just the password. In an adversary-in-the-middle attack, the phishing page sits between the user and the real sign-in page. The user signs in and completes MFA as normal, and the attacker captures the session token that proves the sign-in happened.
With that token, and usually the password as well, the attacker can use the account without passing MFA again until the session is revoked. That is why a password change is not enough on its own: sessions and tokens must be revoked, and the way in must be closed.
- Token theft: a stolen session token reused from another location
- MFA fatigue: repeated prompts until someone approves one
- Consent phishing: a malicious app granted access to mail and files
- Password reuse: a password leaked elsewhere tried against your account
Why passkeys stop this attack
Phishing-resistant methods, such as passkeys and hardware security keys, are bound to the real sign-in site, so a fake page cannot capture a usable sign-in.
They are a strong choice for administrators, executives and anyone who approves payments. Atlantic Computer Systems, our parent company, has more guides on phishing, MFA and other common threats.
Containment and forensics
How we contain and investigate account compromise
We help you lock the attacker out: revoke sessions, remove unknown MFA methods, rules, forwarding and app consents, and check for related accounts and devices. Each change is recorded so the evidence survives.
Our in-house forensic team then reviews sign-in logs, mailbox audit logs and file-access records in Microsoft 365 or Google Workspace to establish what the attacker did, as far as the available logs allow, with documented chain of custody. See how we investigate a compromise.
- When and where the attacker signed in
- Which emails and files were opened, downloaded or shared
- What the account sent, and to whom
- Whether other accounts were targeted or compromised
Is it a bigger incident?
A hacked account can be the start of Business Email Compromise or a wider intrusion.
If payments or bank details are involved, see our BEC and wire fraud guidance. If sensitive data may be involved, see data breach response.
Coordination and recovery
After the account is secure
Once the attacker is locked out, what comes next depends on what they could see and send. If the compromise reached further than one account, see recovery and protection after an attack.
01
Notify your insurer if required
Some policies require notice of any suspected compromise. Check yours. We document what we found and what was done, and coordinate with your insurer when you authorize it.
02
Involve counsel if data was exposed
If the mailbox held customer, patient or financial data, your counsel can advise whether notification obligations apply. We provide the evidence.
03
Restore the account cleanly
We help confirm the account and device are clean, settings are restored and the user can work safely again.
04
Watch for a return
Monitoring for risky sign-ins and new rules helps catch an attacker trying again with what they learned.
Prevention
Make accounts harder to take over
Phishing will keep arriving. These controls make a successful click much less damaging.
Phishing-resistant MFA
Passkeys or security keys for administrators, executives and finance staff, with MFA for everyone else.
Conditional access
Sign-in policies that check the device, location and risk level before granting access to email and files. Atlantic Computer Systems, our parent company, can configure these policies as part of its managed cybersecurity services.
Identity monitoring in MDR
Our in-house SOC analysts monitor Microsoft 365 and Google Workspace sign-ins 24/7 and can disable a compromised account under rules agreed with you in advance.
Security awareness training
Phishing simulations and short lessons help people spot fake sign-in pages and report them.
First-hour guide for BEC
If a hacked account is used for payment fraud, our first-hour checklist shows what to do, in order.
Incident-response planning
A written plan and a tabletop exercise, so your team knows who does what the next time an account is compromised.
FAQ
Phishing and account compromise questions
If you entered a password or approved an MFA prompt, reset the password from a different, trusted device and ask your IT team to revoke your sessions. Tell IT or your security provider right away, even if nothing seems wrong. If you only clicked and entered nothing, report it so the device can be checked. If you need help, ACS Cyber’s 24/7 incident line is 1-650-300-7557.
Common signs include sign-ins from unfamiliar locations, MFA prompts you did not request, new inbox rules or forwarding, and contacts receiving emails you did not send. Administrators can confirm by reviewing sign-in and audit logs.
No. Attackers who stole a session token can stay signed in after a password change. You also need to revoke sessions, remove unknown MFA methods, check inbox rules, forwarding and app consents, and find out how the attacker got in.
Common techniques include adversary-in-the-middle phishing pages that capture session tokens, repeated MFA prompts until someone approves one, and malicious app consents. Phishing-resistant MFA and conditional access reduce these risks.
Phishing-resistant MFA uses methods such as passkeys or hardware security keys that are bound to the real website, so a fake sign-in page cannot capture a usable sign-in. CISA recommends it, and it is especially valuable for administrators, executives and anyone who approves payments.
If the account sent phishing or payment requests, yes. Warn those contacts by phone or another channel so they do not click or pay. Whether you have formal notification obligations is a question for your counsel.
24/7 incident line
Think an account is compromised right now?
Call 1-650-300-7557 and we will walk you through containment. If the incident is over and you want to strengthen sign-in security, book a free 30-minute consultation. For other incidents, see how we help after any compromise.