Akun email yang diretas: aturan penerusan dan pemulihan tersembunyi¶

Your primary email account is the skeleton key to your entire digital, financial, and legal identity. Unlike a compromised social media profile or streaming login, a hacked Gmail, Microsoft Outlook / Microsoft 365, Yahoo, Apple iCloud Mail, or ProtonMail account gives an attacker the power to click "Forgot Password" on your bank accounts, cryptocurrency exchanges, retirement brokerages, tax portals, and cloud drives. Most dangerously, merely changing your email password and turning on Two-Factor Authentication (2FA) rarely kicks a sophisticated attacker out of a hacked inbox. Within 30 seconds of breaking into an email account, modern attackers plant five layers of silent persistence backdoors: hidden Inbox Sweep and Forwarding Rules (often named ., .., atau [Blank] yang secara diam-diam memindahkan email pengaturan ulang kata sandi langsung ke Trash atau RSS Feeds folder so you never see them), Third-Party OAuth Application Grants (eM Client, Thunderbird, or fake Google Docs apps that retain full API read/write access without needing your password), Delegated Mailbox Permissions, App Passwords (IMAP/SMTP), and Recovery Email / Phone Number swaps.

If an email compromise involves immediate threats of physical violence, stalking, domestic abuse, or extortion against a minor, call your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom) or consult our directory of international nomor darurat right away. For all consumer and corporate inbox takeovers, execute the 6-step eradication sequence below in exact order.

Lakukan ini sekarang¶

1. Do NOT change your password from the same Windows PC or Mac if you suspect an Infostealer virus: If your email was hacked even though you already had Two-Factor Authentication (2FA) turned on, your computer likely has an Infostealer malware infection (such as Lumma Stealer, RedLine, or Atomic macOS Stealer) or a malicious Chrome/Edge extension that steals live authenticated browser session cookies (SAPISID/SID on Google or ESTSAUTH on Microsoft). Pick up a clean smartphone (iOS or Android) to perform your password change and security cleanup right now.
2. Audit and revert your Account Recovery Email, Recovery Phone Number, and MFA Authenticator devices BEFORE changing your password (or within 30 seconds after): Attackers immediately add their own burner phone number, disposable email address, or rogue Authenticator app to your security settings. If you change your password without deleting the attacker's recovery phone or rogue passkey, the attacker will simply click "Forgot Password" 10 seconds later and lock you out permanently.
3. Hentikan paksa semua sesi login aktif, cookie browser persisten, dan Kata Sandi Aplikasi secara global: Mengubah kata sandi tidak selalu langsung mematikan token IMAP seluler atau cookie sesi web aktif yang ada. Klik secara eksplisit "Keluar dari semua perangkat / Cabut semua sesi" di dasbor keamanan Google, Microsoft, Yahoo, atau Apple Anda, dan hapus setiap 16 karakter Kata Sandi Aplikasi di akun.
4. Buka browser web desktop (bukan aplikasi email seluler) dan hapus semua Aturan Kotak Masuk, Filter, Penerusan Otomatis, dan Aturan Sapu yang tersembunyi: Aplikasi email seluler (Gmail atau Outlook di iOS/Android) sering kali menyembunyikan aturan perutean sisi server tingkat lanjut. Buka pengaturan email web Anda di browser desktop dan periksa Filter dan Alamat yang Diblokir, Penerusan dan POP/IMAP, dan Aturan / Sapu. Hapus aturan apa pun yang meneruskan email secara eksternal atau secara otomatis memindahkan email yang berisi kata-kata seperti "bank", "code", "reset", "security", "wire", "invoice", atau "crypto" ke dalam Trash, Archive, atau RSS Feeds map.
5. Cabut semua Aplikasi dan Delegasi Kotak Surat Pihak Ketiga yang Terhubung dengan OAuth: Navigasikan ke Aplikasi & Layanan Pihak Ketiga (Google) akun Anda atau Aplikasi dan Layanan yang telah Anda beri akses (Microsoft/Yahoo) dan cabut setiap aplikasi dengan Mail.Read, Mail.ReadWrite, atau Gmail API izin, plus centang Berikan Akses ke Akun Anda (Delegasi) sehingga penyerang tidak dapat membaca kotak masuk Anda melalui token OAuth yang sepenuhnya mengabaikan perubahan sandi.
6. Periksa Anda Trash (Bin), Sent, dan Spam folder segera untuk melihat akun keuangan atau kripto mana yang telah disetel ulang oleh penyerang: Penyerang menghapus peringatan keamanan yang masuk dari bank Anda, Coinbase/Binance, Amazon, PayPal, atau Steam beberapa detik setelah menerima kode verifikasi 6 digit. Buka milikmu Trash dan Sent folder saat ini: setiap email pengaturan ulang kata sandi yang ada di folder Anda Trash adalah akun yang telah dibobol atau coba dibobol oleh penyerang.

Pohon keputusan: mendapatkan kembali kendali dan membersihkan pintu belakang persistensi¶

Ikuti pohon triase langkah demi langkah ini apakah Anda masih memiliki akses ke kotak masuk atau telah dikunci sepenuhnya oleh penyerang:

flowchart TD
    A["Akun Email yang Dicurigai atau Dikonfirmasi Disusupi"] --> B{"Apakah Anda masih bisa masuk ke akun email Anda saat ini?"}
    B -->|"Ya: Saya masih memiliki akses"| C["Beralih ke Smartphone yang Bersih (Hindari PC yang Berpotensi Terinfeksi)"]
    C --> D["1. Hapus Telepon Pemulihan Penyerang, Email Pemulihan & Kunci Sandi MFA Nakal"]
    D --> E["2. Ubah Kata Sandi menjadi Frasa Sandi 20+ Char Unik & Aktifkan 2FA Tahan Phishing"]
    E --> F["3. Klik 'Keluar dari Semua Perangkat' & Hapus Semua Kata Sandi Aplikasi 16-Char"]
    F --> G["4. Buka Webmail Desktop: Bersihkan Penerusan Tersembunyi, Filter, Aturan Sapu & Delegasi"]
    G --> H["5. Cabut Aplikasi Pihak Ketiga OAuth & Periksa Folder Sampah/Folder Terkirim untuk Akun Eksternal yang Dibobol"]
    B -->|"Tidak: Penyerang mengubah kata sandi dan telepon pemulihan/MFA"| I{"Jenis akun email apa yang dikunci?"}
    I -->|"Domain Kerja / Sekolah / Perusahaan (@company.com)"| J["Hubungi Admin TI Segera: Admin Dapat Mengatur Ulang MFA, Mencabut Token & Memulihkan Akses dalam 60 Detik melalui Konsol Admin"]
    I -->|"Gmail Pribadi / Outlook.com / Yahoo / iCloud"| K["Jalankan Formulir Pemulihan Akun Otomatis dari IP Wi-Fi Rumah Historis Anda dan Browser/Telepon yang Dikenal"]
    K --> L["Segera Hubungi Bank Anda, Operator Seluler & Pertukaran Kripto melalui Telepon untuk Membekukan Akun yang Terikat dengan Email Itu"]

Fase 1: Audit persistensi pembersihan mendalam oleh penyedia email (Gmail, Outlook/M365, Yahoo, iCloud)¶

Setiap penyedia email besar menyimpan aturan penerusan, filter, token OAuth, dan delegasi kotak surat dalam menu yang sedikit berbeda. Meskipun Anda menggunakan Apple Mail atau Outlook Desktop di komputer, Anda harus masuk ke antarmuka email web resmi penyedia di browser desktop (atau meminta "Situs Desktop" di browser seluler Anda) untuk melihat pengaturan sisi server ini.

Detailed Walkthrough 1: Purging a Hacked Google / Gmail Account¶

When cleaning a compromised Gmail or Google Workspace account, work through these exact seven tabs without skipping a single one:

1. Audit Security & Passkeys (myaccount.google.com/security):
   • Klik Kunci sandi dan kunci keamanan: Penyerang segera mendaftarkan kunci sandi atau pengautentikasi virtual yang disinkronkan di browser mereka sendiri sehingga mereka dapat masuk kembali tanpa kata sandi dan tanpa perintah SMS. Hapus kunci sandi apa pun yang tidak Anda kenali dengan kepastian 100 persen.
   • Click 2-Step Verification -> check Authenticator, Google Prompt devices, Recovery phone, and Backup codes. Click Generate new codes to immediately invalidate any 8-digit backup codes the attacker screenshotted.
2. Destroy Active App Passwords (myaccount.google.com/apppasswords):
   • Sandi Aplikasi adalah kode sandi 16 huruf yang memungkinkan klien email IMAP (seperti Thunderbird atau skrip Python peretas) mengunduh seluruh kotak masuk Anda selamanya sambil sepenuhnya melewati Verifikasi 2 Langkah. Hapus setiap Kata Sandi Aplikasi yang terdaftar.
3. Revoke Third-Party OAuth Connections (myaccount.google.com/connections):
   • Look for any application granted access to Gmail, Google Drive, or Google Contacts (attackers often use legitimate-looking mail clients like eM Client, Newton Mail, Cleanfox, or custom OAuth scripts). Click the app -> Delete all connections you have with [App Name].
4. Check Gmail Accounts and Import Tab (Mail Delegation & Reply-To Hijacking):
   • In Gmail on a desktop computer, click the Gear icon -> See all settings -> Accounts and Import.
   • Di bagian Berikan akses ke akun Anda, verifikasi bahwa NOL alamat email tercantum. Pengguna yang didelegasikan dapat membaca, mengirim, dan menghapus email Anda tanpa mengetahui kata sandi Anda.
   • Di bawah Kirim email sebagai, klik edit info di samping nama Anda dan verifikasi bahwa penyerang tidak memasukkan rahasia Specify a different "reply-to" address (misalnya, menyetel Balasan Ke ke yourname.company@gmail.com atau domain serupa penyerang sehingga setiap kali seseorang membalas email sah Anda, balasannya ditujukan kepada peretas, bukan Anda).
5. Check Gmail Filters and Blocked Addresses tab:
   • Perhatikan baik-baik setiap filter. Penyerang sering kali membuat filter yang cocok from:(a|e|i|o|u) atau size > 0 atau has:attachment atau kata kunci seperti invoice, wire, bank, security, alert, code dengan tindakan Skip the Inbox (Archive it), Mark as read, Delete it, atau Forward it to:. Hapus setiap filter asing.
6. Check Gmail Forwarding and POP/IMAP tab:
   • Pastikan Penerusan disetel ke Nonaktifkan penerusan, hapus alamat penerusan yang tidak dikenal dari daftar tarik-turun, dan setel Akses IMAP ke Nonaktifkan IMAP (kecuali Anda secara khusus menggunakan klien desktop yang aman).
7. Periksa Sampah Google Drive & Riwayat Google Takeout:
   • Penyerang sering kali memicu Google Takeout (takeout.google.com) arsip untuk diunduh a .zip semua email, Google Foto, dan dokumen Google Drive Anda, termasuk laporan pajak dan daftar kata sandi. Kunjungi takeout.google.com sekarang: jika Anda melihat ekspor aktif atau selesai yang tidak Anda minta, klik Batalkan ekspor dan lihat kategori data mana yang dikemas.

Panduan Lengkap 2: Membersihkan Akun Microsoft Outlook.com / Hotmail / Microsoft 365 yang Diretas¶

akun Microsoft (@outlook.com, @hotmail.com, @live.com, @msn.com, dan kotak surat Microsoft 365 Exchange Online perusahaan) memiliki beberapa tempat persembunyian unik yang dieksploitasi penyerang selama Business Email Compromise (BEC) dan peretasan konsumen:

1. Yang Tersembunyi RSS Feeds dan Conversation History Perangkap Folder:
   • Di Outlook, penyerang jarang mengarahkan email yang disembunyikan ke email utama Deleted Items folder karena pengguna memeriksa Deleted Items. Sebaliknya, mereka membuat Aturan Outlook yang diberi nama . atau 1 yang memindahkan email masuk ke RSS Feeds, Archive, atau Conversation History folder dan tandai sebagai sudah dibaca. Periksa setiap folder di sidebar kiri Anda, terutama RSS Feeds, sekarang.
2. Audit Keduanya Rules DAN Sweep di Web Outlook (outlook.live.com atau outlook.office.com):
   • Klik Settings Gear (kanan atas) -> Mail -> Rules. Hapus aturan apa pun yang tidak Anda buat.
   • Perhatikan kotak centang di bagian bawah aturan penyerang: Stop processing more rules. Penyerang mencentang kotak ini pada aturan teratas mereka sehingga tidak ada aturan sah Anda yang berjalan.
   • Selanjutnya, klik Mail -> Sweep dan Mail -> Junk email -> Blocked senders and domains. Penyerang secara rutin menambahkan @microsoft.com, @google.com, @apple.com, @chase.com, @bankofamerica.com, dan @coinbase.com ke daftar Pengirim dan Domain yang Diblokir sehingga peringatan keamanan terpental atau masuk secara diam-diam ke Sampah. Hapus daftar Pengirim yang Diblokir dari perusahaan yang sah.
3. Memeriksa Mail -> Forwarding and IMAP:
   • Pastikan Aktifkan penerusan tidak dicentang. Jika alamat email penyerang ada di dalam kotak dengan "Keep a copy of forwarded messages" tidak dicentang, setiap email yang dikirimkan kepada Anda diteruskan ke peretas dan dihapus dari kotak surat Anda sebelum masuk ke Kotak Masuk Anda.
4. Untuk Administrator Perusahaan Microsoft 365: Jalankan PowerShell untuk Mengungkap Aturan MAPI Tersembunyi/Kotak Masuk Rusak (MFCMAPI):
   • Pelaku ancaman BEC yang canggih menggunakan Exchange Web Services (EWS) API atau MFCMAPI untuk membuat aturan Kotak Masuk rusak yang tersembunyi (dengan menghapus PR_RULE_MSG_NAME dan PR_RULE_MSG_PROVIDER Properti MAPI) yang tidak muncul sama sekali di GUI Web Outlook atau Pusat Admin Exchange standar.
   • Administrator TI harus terhubung ke Exchange Online PowerShell dan menjalankan:

     Get-InboxRule -Mailbox victim@yourdomain.com -IncludeHidden | Format-List Name,Enabled,Description,ForwardTo,ForwardAsAttachmentTo,RedirectTo,DeleteMessage,MoveToFolder
     

   • Menambahkan -IncludeHidden tanda memperlihatkan aturan MAPI tersembunyi yang bersembunyi di tabel Konten Terkait kotak surat (FAI), yang kemudian dapat dibersihkan melalui Remove-InboxRule -Mailbox victim@yourdomain.com -Identity "<RuleID>" or by launching outlook.exe /cleanrules.
   • Also inspect Tenant-Level Exchange Transport Rules (Mail Flow Rules) via Get-TransportRule: if the attacker compromised an Exchange Administrator account, they may have created a global organization-wide mail flow rule rather than an individual mailbox rule.

Phase 2: What to do if you are completely locked out (Attacker changed password & 2FA)¶

If the attacker already changed your password, replaced your recovery phone number with their own, and turned on their own Authenticator app or hardware key, every minute counts because the attacker is actively looting your linked accounts while you are locked out.

Step 1: Cut Off the Attacker's Financial Leverage First (First 15 Minutes)¶

Do not spend three hours fighting an automated email recovery form while the hacker drains your bank account using your hijacked inbox:

1. Call Your Banks, Credit Card Issuers, and Investment Brokerages by Telephone:
   • Tell the Fraud Department: "My primary email address [your@email.com] has been compromised and I am currently locked out of it. Place an immediate verbal password / security freeze on my profile, revoke active web/mobile sessions, and remove that email address from self-service password resets."
2. Lock Your Mobile Phone Carrier Account Against a Follow-On SIM Swap:
   • Inside your hacked inbox, the attacker can read your monthly AT&T, Verizon, T-Mobile, Rogers, Vodafone, or O2 bills, giving them your mobile account number and billing address. Call your carrier immediately to verify your Number Transfer PIN / Port Freeze and Account Passcode are locked down.
3. Freeze Your Cryptocurrency Exchange Accounts (Coinbase, Binance, Kraken, Gemini):
   • Most major exchanges provide a one-click or emergency phone Account Lock if your email is compromised (for example, calling Coinbase automated emergency lock at +1 (888) 908-7930 in the US/International or +44 808 168 4635 in the UK).
4. Change the Registered Email Address on Every Account You Can Still Log Into:
   • You are likely still logged in to Amazon, PayPal, Venmo, Steam, Discord, Apple ID, and your password manager on your smartphone app right now. Create a brand-new, clean emergency email account (for example, on ProtonMail or a fresh Gmail secured with a hardware key) and immediately go into the app settings of your still-logged-in apps to switch their contact email away from the hacked address before the attacker resets them.

Step 2: How to Pass the Automated Account Recovery Algorithms (Google, Microsoft, Yahoo)¶

For free consumer email accounts (@gmail.com, @outlook.com, @hotmail.com, @yahoo.com), human support agents are strictly prohibited by engineering controls from manually resetting passwords or bypassing 2FA over the phone (to prevent social engineering). Instead, recovery is governed by an automated Risk & Identity Scoring Engine. To maximize your cryptographic trust score and trigger the hidden "7-Day / 30-Day Security Hold Override":

1. CRITICAL RULE: Submit the Recovery Form from Your Exact Historical Device, Browser, and Home Wi-Fi IP Address:
   • Jangan pernah lari accounts.google.com/signin/recovery atau account.live.com/acsr from a brand-new incognito browser window on cellular data or through a VPN.
   • Use the exact laptop, desktop, or smartphone and the exact browser (with intact cookies/local storage) where you have logged into that email account every day for the past year, while connected to your normal home or office Wi-Fi router (ASN and geolocation match). The recovery algorithm heavily weights device fingerprint tokens (DeviceID) and historical IP subnets.
2. Google / Gmail Recovery (accounts.google.com/signin/recovery):
   • Even if the attacker changed your recovery phone and recovery email seconds ago, Google retains your PREVIOUS recovery phone number and PREVIOUS recovery email address as valid recovery factors for exactly 7 calendar days (168 hours) after an attacker modifies them.
   • Saat diminta selama signin/recovery, click "Try another way" until it offers to send a code to your original phone number or original recovery email address, or prompts your previously registered Android phone/iPhone via Google Prompt.
   • If You Subscribe to Google One (Paid Cloud Storage) or YouTube Premium / YouTube Channel:
     • Paid Google One subscribers have access to live human Google One Support (one.google.com/support) who can escalate locked accounts internally.
     • If your hacked Google account owns a YouTube Channel, contact @TeamYouTube on X (formerly Twitter) publicly right away. Unlike standard Gmail, @TeamYouTube Creator Support provides a dedicated Hacked Account Escalation Form piloted by human Google trust-and-safety engineers who verify your original Channel ID (UC..), AdSense ID, and upload IP history to physically strip the attacker's passkeys/MFA and restore your entire Google/Gmail account within 24 to 72 hours.
3. Microsoft Outlook / Hotmail / Xbox Account Recovery (account.live.com/acsr):
   • First, try logging in and clicking "I don't have any of these" at the 2FA screen: if you have a 25-character Microsoft Recovery Code saved when you originally set up your account, entering it lets you replace the attacker's security info (subject to Microsoft's mandatory 30-day security info replacement waiting period, during which the attacker can also be blocked if you flag the account).
   • When filling out the Microsoft Account Recovery Form (account.live.com/acsr) from your home Wi-Fi IP:
     • Provide the exact Subject lines of 3 to 4 recent emails you sent (ask friends or family to look in their own inbox and read you the exact character-for-character Subject lines of emails you sent them recently).
     • Provide the exact email addresses of contacts you recently emailed.
     • Provide your Xbox Console Hardware LiveDeviceID / Serial Number if you ever signed into an Xbox with that Microsoft account, and the last 4 digits and expiration date of any credit card ever used on Microsoft Store / Skype / Office 365.

Phase 3: Damage control for secrets exposed inside your old emails¶

Once you have locked the attacker out and cleaned all rules and OAuth tokens, you must confront a sobering forensic reality: if the attacker had IMAP, OAuth, or web access to your mailbox for even 15 minutes, assume they ran an automated keyword search across your entire historical email archive.

Attackers do not read your 50,000 old emails manually. Their automated scripts immediately search your inbox for these exact ten high-value keywords and download every matching message and PDF attachment:

1. "seed", "mnemonic", "recovery phrase", "24 words", "wallet", "Coinbase", "Binance", "Ledger": If you ever emailed yourself a photo, text note, or encrypted zip of a cryptocurrency seed phrase or 2FA backup code, consider that wallet compromised immediately and move all funds to a brand-new hardware wallet.
2. "tax", "1040", "W-2", "1099", "SSN", "Social Security", "passport", "driver license", "mortgage", "closing": Loan applications, apartment leases, and CPA emails inside your inbox almost certainly contain PDFs with your unredacted Social Security Number (or national ID), date of birth, and driver's license photo. Place an immediate Credit Freeze with Equifax, Experian, and TransUnion (see our guide on identity theft response).
3. "password", "login", "credentials", "welcome to", "backup codes": Search your own inbox right now for the words password dan backup code, delete those dangerous plaintext emails after rotating every single password mentioned in them.
4. "invoice", "ACH", "wire", "routing", "escrow", "closing costs", "docusign": If you are in the middle of buying a house, paying a contractor, or running a business, the attacker now has copies of your real invoices and banking routing details and will attempt to impersonate you or your title company to steal the wire transfer. Call your real estate title company, escrow officer, or clients on the telephone immediately to warn them.

Pertanyaan yang sering diajukan¶

Sumber diperiksa¶

• Cybersecurity and Infrastructure Security Agency (CISA, United States): Protecting Against Business Email Compromise (BEC), OAuth Application Abuse, and Phishing-Resistant MFA Guidance (cisa.gov/MFA dan cisa.gov).
• Microsoft Security Response Center & Defender Threat Intelligence (United States): Responding to a Compromised Email Account in Microsoft Defender for Office 365 (Hidden Inbox Rules -IncludeHidden, OAuth Consent Grants, and Session Revocation) (learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account).
• Google Account Security & Workspace Admin Help (United States): Secure a Hacked or Compromised Google Account, OAuth Third-Party Connections, and Advanced Protection Program (support.google.com/accounts/answer/6294825).
• National Cyber Security Centre (NCSC, United Kingdom): Recovering a Compromised Email Account and Mitigating Email Forwarding Rule Persistence (ncsc.gov.uk).
• Federal Trade Commission (FTC, United States): What To Do if Your Email Account Is Hacked (consumer.ftc.gov).
• Australian Cyber Security Centre (ACSC / ASD, Australia): Protecting Email Accounts and Detecting Unauthorized Inbox Rules (cyber.gov.au).

Panduan terkait¶

• Akun phishing dan disusupi
• MFA phishing and adversary-in-the-middle bypass
• Penguncian MFA dan pemulihan autentikator
• Respons pelanggaran data dan kebocoran kata sandi
• Infeksi malware, ransomware, dan spyware
• pertukaran SIM