Skip to content

Akun email sing disusupi: aturan terusake sing didhelikake lan pemulihan

Nomer darurat beda-beda miturut negara. Kaca iki nggunakake 911, nomer kanggo Amerika Serikat lan Kanada. Akeh negara liya nggunakake 112, 999, utawa nomer liyane. Temokake nomer kanggo negara sampeyan.

Akun email utama sampeyan minangka kunci kerangka kanggo kabeh identitas digital, finansial, lan legal sampeyan. Ora kaya profil media sosial utawa login streaming sing dikompromi, akun Gmail, Microsoft Outlook / Microsoft 365, Yahoo, Apple iCloud Mail, utawa ProtonMail sing disusupi menehi penyerang kekuwatan kanggo ngeklik "Kelalen Sandi" ing akun bank, ijol-ijolan cryptocurrency, broker pensiun, portal pajak, lan drive awan. Sing paling mbebayani, mung ngganti tembung sandhi email lan nguripake Two-Factor Authentication (2FA) arang banget nyepak panyerang canggih metu saka kothak mlebu sing disusupi. Ing 30 detik sawise mlebu akun email, panyerang modern nandur limang lapisan backdoor ketekunan bisu: didhelikake Aturan Sapuan lan Penerusan Kothak Masuk (asring dijenengi ., .., utawa [Blank] sing meneng mindhah email-reset sandi langsung menyang Trash utawa RSS Feeds folder supaya sampeyan ora bisa ndeleng), Hibah Aplikasi OAuth Pihak Ketiga (eM Client, Thunderbird, utawa palsu Google Docs app sing nahan akses maca/nulis lengkap API tanpa mbutuhake tembung sandhi), Ijin Kothak Surat sing Didelegasikan, Sandhi Aplikasi (IMAP/SMTP), lan Swap Email Recovery / Nomer Telpon.

Yen kompromi email nglibatake ancaman kekerasan fisik, stalking, penyalahgunaan rumah tangga, utawa pemerasan marang bocah cilik, hubungi nomer darurat lokal sampeyan (911 ing Amerika Serikat lan Kanada, 112 liwat Uni Eropa, 999 ing Inggris) utawa takon direktori internasional kita nomer darurat langsung wae. Kanggo kabeh pengambilalihan kothak mlebu konsumen lan perusahaan, nglakokake urutan pambusakan 6-langkah ing ngisor iki kanthi urutan sing tepat.

Apa iki saiki

  1. Aja ngganti tembung sandhi saka PC Windows utawa Mac sing padha yen sampeyan curiga ana virus Infostealer: Yen email sampeyan disusupi senajan sampeyan wis nguripake Two-Factor Authentication (2FA), komputer sampeyan bisa uga kena infeksi Infostealer malware (kayata Lumma Stealer, RedLine, utawa Atomic Stealer) utawa ekstensi browser Chrome/Edge sing mbebayani.SAPISID/SID ing Google utawa ESTSAUTH ing Microsoft). Pilih smartphone sing resik (iOS utawa Android) kanggo ngganti tembung sandhi lan ngresiki keamanan saiki.
  2. Audit lan mbalekake Email Recovery Akun, Nomer Telpon Recovery, lan piranti MFA Authenticator sadurunge ngganti tembung sandhi (utawa ing 30 detik sawise): Panyerang langsung nambah nomer telpon burner dhewe, alamat email nganggo, utawa app Authenticator nakal menyang setelan keamanan. Yen sampeyan ngganti tembung sandhi tanpa mbusak telpon pemulihan utawa sandhi nakal penyerang, panyerang mung bakal ngeklik "Kelalen Sandi" 10 detik mengko lan ngunci sampeyan kanthi permanen.
  3. Mateni kabeh sesi login aktif, cookie browser sing terus-terusan, lan Sandi Aplikasi ing saindenging jagad: Ngganti tembung sandhi ora mesthi langsung mateni token IMAP seluler utawa cookie sesi web sing aktif. Klik kanthi jelas "Metu saka kabeh piranti / Mbusak kabeh sesi" ing dashboard keamanan Google, Microsoft, Yahoo, utawa Apple, lan mbusak saben 16 karakter Sandhi Aplikasi ing akun kasebut.
  4. Mbukak browser web desktop (dudu aplikasi surat seluler) lan busak kabeh Aturan Kothak Masuk, Filter, Penerus Otomatis, lan Aturan Sapuan: Aplikasi mail seluler (Gmail utawa Outlook ing iOS / Android) asring ndhelikake aturan rute sisih server sing luwih maju. Bukak setelan email web sampeyan ing browser desktop lan priksa Saringan lan Alamat Diblokir, Nerusake lan POP/IMAP, lan Aturan / Sapuan. Mbusak aturan apa wae sing nerusake email sacara eksternal utawa kanthi otomatis mindhah email sing ngemot tembung kaya "bank", "code", "reset", "security", "wire", "invoice", utawa "crypto" menyang Trash, Archive, utawa RSS Feeds folder.
  5. Mbusak kabeh Aplikasi lan Delegasi Kothak Surat OAuth Pihak Katelu: Navigasi menyang akun Aplikasi & Layanan Pihak Ketiga (Google) utawa Aplikasi lan Layanan sing wis diwenehi akses (Microsoft/Yahoo) lan mbatalake saben aplikasi sing nganggo Mail.Read, Mail.ReadWrite, utawa Gmail API ijin, plus mriksa ** Menehi Akses menyang Akun (Delegasi) ** supaya panyerang ora bisa maca kothak mlebu liwat token OAuth sing ora nglirwakake owah-owahan sandi.
  6. ** Priksa sampeyan Trash (Bin), Sent, lan Spam folder kasebut langsung kanggo ndeleng akun finansial utawa crypto sing wis direset dening panyerang **: Penyerang mbusak tandha keamanan sing mlebu saka bank, Coinbase / Binance, Amazon, PayPal, utawa Steam detik sawise nampa kode verifikasi 6 digit. Bukak Panjenengan Trash lan Sent folder saiki: saben email-reset sandi lungguh ing Panjenengan Trash minangka akun sing wis dilanggar utawa dicoba dilanggar dening panyerang.

Danger

Napa sampeyan ora weruh yen bank, PayPal, utawa ijol-ijolan crypto ngirim 10 email tandha keamanan nalika sampeyan dirampok? Amarga sing paling dhisik sing ditindakake panyerang ing kothak mlebu Gmail utawa Outlook sing disusupi yaiku nggawe Aturan Penindasan Bisu (contone: Yen Pangirim ngemot @chase.com, @coinbase.com, @paypal.com, utawa Subyek ngemot Verification Code, Security Alert, Password, Login -> Tandhani minangka Waca LAN Lewati Kothak Masuk LAN Pindhah menyang Sampah / Arsip / Umpan RSS). Tansah priksa tab Aturan / Filter lan folder Sampah / Arsip dhisik, Kothak mlebu utama sampeyan sengaja disensor dening panyerang.

Wit keputusan: entuk kontrol maneh lan ngresiki lawang mburi

Tindakake wit triase langkah-langkah iki manawa sampeyan isih duwe akses menyang kothak mlebu utawa wis dikunci kabeh dening panyerang:

flowchart TD
    A["Disangka utawa Dikonfirmasi Akun Email Kompromi"] --> B{"Apa sampeyan isih bisa mlebu menyang akun email sampeyan saiki?"}
    B -->|"Ya: Aku isih duwe akses"| C["Ngalih menyang Smartphone sing resik (Ngindhari PC sing Bisa Diinfeksi)"]
    C --> D["1. Copot Attacker kang Recovery telpon, Recovery Email & Rogue MFA Passkeys"]
    D --> E["2. Ganti Sandi menyang Unik 20+ Char Passphrase & Aktifake Phishing-Resistant 2FA"]
    E --> F["3. Klik 'Metu Kabeh Piranti' & Busak Kabeh 16-Char App Sandi"]
    F --> G["4. Bukak Webmail Desktop: Purge Hidden Forwarding, Filters, Sweep Rules & Delegates"]
    G --> H["5. Cabut Aplikasi Pihak Katelu OAuth & Priksa Sampah/Folder sing Dikirim kanggo Akun Eksternal sing Dilanggar"]
    B -->|"Ora: Attacker ngganti tembung sandhi lan telpon pemulihan / MFA"| I{"Apa jinis akun email sing dikunci?"}
    I -->|"Domain Kerja / Sekolah / Perusahaan (@company.com)"| J["Hubungi Admin IT Langsung: Admin Bisa Reset MFA, Cabut Token & Mulihake Akses ing 60 Detik liwat Konsol Admin"]
    I -->|"Gmail pribadi / Outlook.com / Yahoo / iCloud"| K["Jalanake Formulir Pemulihan Akun Otomatis saka IP Wi-Fi Ngarep Sejarah lan Browser / Telpon sing Dikenal"]
    K --> L["Langsung Telpon Bank, Operator Seluler & Ijol-ijolan Crypto liwat Telpon kanggo Membekukan Akun sing Disambungake menyang Email kasebut"]

Fase 1: Audit terus-terusan resik dening panyedhiya email (Gmail, Outlook/M365, Yahoo, iCloud)

Saben panyedhiya email utama nyimpen aturan penerusan, saringan, token OAuth, lan delegasi kothak layang ing menu sing rada beda. Sanajan sampeyan nggunakake Apple Mail utawa Outlook Desktop ing komputer, sampeyan ** kudu mlebu menyang antarmuka webmail resmi panyedhiya ing browser desktop** (utawa njaluk "Situs Desktop" ing browser seluler sampeyan) kanggo ndeleng setelan sisih server kasebut.

Mekanisme Ketahanan Google Gmail / Google Workspace Microsoft Outlook.com / Microsoft 365 Yahoo Mail / AOL Mail Apple iCloud Mail
1. Info Recovery & Piranti MFA myaccount.google.com/security -> Verifikasi 2-Langkah, Sandhi, Telpon Recovery, Email Recovery. account.microsoft.com/security -> ** Ngatur carane aku mlebu ** (Pribadi) utawa mysignins.microsoft.com/security-info (Kerja/Sekolah). login.yahoo.com/myaccount/security -> Verifikasi rong langkah, Nomer telpon pemulihan, Alamat email pemulihan. account.apple.com -> Mlebu lan Keamanan -> Keamanan Akun (Nomer Telpon & Piranti Dipercaya).
2. Meksa Metu saka Kabeh Sesi myaccount.google.com/device-activity -> Klik saben piranti sing ora dikenal -> Mlebu. account.microsoft.com/security -> Mlebu metu nang endi wae (mbutuhake nganti 24 jam kanggo konsumen; cepet ing ID Entra Revoke sessions). login.yahoo.com/myaccount/activity -> Aktivitas paling anyar -> Mlebu saka lokasi/browser sing ora dingerteni. Settings -> [Your Name] ing iPhone -> Gulung mudhun menyang dhaptar piranti -> Tutul piranti sing ora dingerteni -> Busak saka Akun.
3. Aturan & Filter Kothak mlebu sing didhelikake Gmail Web -> Setelan (Gear) -> Deleng kabeh setelan -> Tab Filter lan Alamat Diblokir. Outlook Web -> Setelan (Gear) -> Mail -> Aturan, LAN Mail -> Sweep, LAN Email sampah (Pangirim sing diblokir). Yahoo Web -> Setelan (Gear) -> Setelan Liyane -> Filter. icloud.com/mail -> Setelan (Gear ing ndhuwur dhaptar Mail) -> Setelan -> Aturan.
4. Terusake Otomatis & POP/IMAP Gmail Web -> Setelan -> Deleng kabeh setelan -> Nerusake lan tab POP/IMAP. Outlook Web -> Setelan (Gear) -> Mail -> Nerusake (lan Nerusake lan IMAP). Yahoo Web -> Setelan -> Setelan Liyane -> Kotak Surat -> Klik alamat email sampeyan -> Teruskan. icloud.com/mail -> Setelan (Gear) -> Setelan -> Nerusake (Forward my email to).
5. Delegasi kothak layang & Alias Gmail Web -> Setelan -> Deleng kabeh setelan -> Akun lan Impor -> Priksa Izin akses menyang akun & Kirim surat minangka. Pusat Admin Microsoft 365 Exchange -> Kotak Surat -> Delegasi (Read and manage / Send as / Send on behalf). Yahoo Web -> Setelan -> Setelan Liyane -> Kotak Surat -> Alamat email mung kirim & Alamat sing bisa dibuang. icloud.com/mail -> Setelan -> Alamat (Priksa alias ora sah iCloud utawa Reply-To overrides).
6. Aplikasi OAuth Pihak Katelu & Sandhi Aplikasi myaccount.google.com/connections (Aplikasi OAuth) & myaccount.google.com/apppasswords (Sandhi IMAP 16 karakter). account.live.com/consent/Manage (OAuth pribadi) utawa myapps.microsoft.com (Karya) + Sandhi aplikasi ing Keamanan. login.yahoo.com/myaccount/security -> Sandhi aplikasi & Sambungan eksternal. account.apple.com -> Mlebu lan Keamanan -> Sandhi Khusus Aplikasi -> Cabut Kabeh.

Rincian Walkthrough 1: Mbusak Akun Google / Gmail sing disusupi

Nalika ngresiki akun Gmail utawa Google Workspace sing wis dikompromi, gunakake pitung tab iki kanthi bener tanpa nglewati siji wae:

  1. ** Keamanan Audit & Sandhi (myaccount.google.com/security)**:
    • Klik Sandhi lan kunci keamanan: Panyerang langsung ndhaptar sandi sing diselarasake utawa otentikasi virtual ing browser dhewe supaya bisa mlebu maneh nganggo sandhi nol lan pituduh SMS nol. Busak sembarang sandhi sing ora sampeyan kenal kanthi kepastian 100 persen.
    • Klik Verifikasi 2 Langkah -> priksa Authenticator, Perangkat Google Prompt, Telpon Recovery, lan Kode serep. Klik Generate new codes kanggo langsung mbatalake kode serep 8 digit sing direkam dening panyerang.
  2. Busak Sandi Aplikasi Aktif (myaccount.google.com/apppasswords):
    • Sandi Aplikasi minangka kode sandhi 16 huruf sing ngidini klien mail IMAP (kaya Thunderbird utawa skrip Python peretas) ndownload kabeh kothak mlebu ing salawas-lawase nalika ngliwati Verifikasi 2 Langkah. Mbusak saben sandhi App sing kadhaptar.
  3. Cabut Sambungan OAuth Pihak Katelu (myaccount.google.com/connections):
    • Goleki aplikasi apa wae sing diwenehi akses menyang Gmail, Google Drive, utawa Google Kontak (penyerang asring nggunakake klien email sing katon sah kaya eM Client, Newton Mail, Cleanfox, utawa skrip OAuth khusus). Klik app -> Busak kabeh sambungan sing sampeyan duwe karo [Jeneng Aplikasi].
  4. ** Priksa Gmail Accounts and Import Tab (Delegasi Surat & Reply-To Pembajakan)**:
    • Ing Gmail ing komputer desktop, klik lambang Gear -> Deleng kabeh setelan -> Akun lan Impor.
    • Ing Akses menyang akun, priksa manawa ZERO alamat email wis kadhaptar. Pangguna sing diutus bisa maca, ngirim, lan mbusak email tanpa ngerti tembung sandhi.
    • Ing Kirim email minangka, klik sunting info ing jejere jeneng sampeyan lan verifikasi manawa panyerang ora nglebokake rahasia Specify a different "reply-to" address (contone, nyetel Reply-To kanggo yourname.company@gmail.com utawa domain mirip penyerang supaya saben wong mbales email sampeyan sing sah, balesane menyang peretas tinimbang sampeyan).
  5. ** Priksa Gmail Filters and Blocked Addresses Tab**:
    • Deleng kanthi teliti ing saben saringan. Penyerang asring nggawe saringan sing cocog from:(a|e|i|o|u) utawa size > 0 utawa has:attachment utawa tembung kunci kaya invoice, wire, bank, security, alert, code karo aksi Skip the Inbox (Archive it),Mark as read,Delete it, utawa Forward it to:. Mbusak saben saringan sing ora pati ngerti.
  6. ** Priksa Gmail Forwarding and POP/IMAP Tab**:
    • Verifikasi Nerusake disetel dadi Pateni terusake, mbusak alamat penerusan sing ora dingerteni saka dhaptar gulung mudhun, lan setel Akses IMAP dadi Pateni IMAP (kajaba sampeyan nggunakake klien desktop sing aman).
  7. Priksa Google Drive Trash & Google Takeout History:
    • Penyerang kerep micu Google Takeout (takeout.google.com) arsip kanggo ngundhuh a .zip kabeh email, Google Photos, lan dokumen Google Drive, kalebu bali pajak lan dhaptar sandhi. Dolan maring takeout.google.com sapunika: yen sampeyan ndeleng ekspor aktif utawa wis rampung sing ora dijaluk, klik Batal ekspor lan ndeleng persis kategori data sing dikemas.

Rincian Walkthrough 2: Mbusak akun Microsoft Outlook.com / Hotmail / Microsoft 365 sing disusupi

Akun Microsoft (@outlook.com, @hotmail.com, @live.com, @msn.com, lan kothak layang Microsoft 365 Exchange Online perusahaan) duwe sawetara panggonan ndhelik unik sing dieksploitasi dening panyerang sajrone Kompromi Email Bisnis (BEC) lan peretasan konsumen:

  1. ** Sing Didhelikake RSS Feeds lan Conversation History Folder Trap**:
    • Ing Outlook, panyerang arang ngarahake email sing ditindhes menyang utama Deleted Items folder amarga pangguna mriksa Deleted Items. Nanging, dheweke nggawe Aturan Outlook sing jenenge . utawa 1 sing mindhah email mlebu menyang RSS Feeds,Archive, utawa Conversation History folder lan menehi tandha minangka diwaca. Priksa saben folder ing sidebar kiwa, utamane RSS Feeds, saiki.
  2. ** Audit Loro Rules LAN Sweep ing Outlook Web (outlook.live.com utawa outlook.office.com)**:
    • Klik Settings Gear (tengen ndhuwur) -> Mail -> Aturan. Busak aturan apa wae sing ora digawe.
    • Gatekna kothak centhang ing ngisor aturan penyerang: Stop processing more rules. Penyerang mriksa kothak iki ing aturan paling dhuwur supaya ora ana aturan sing sah.
    • Sabanjure, klik Mail -> Sweep and Mail -> Junk email -> Blocked senders and domains. Penyerang nambah kanthi rutin @microsoft.com, @google.com, @apple.com, @chase.com, @bankofamerica.com, lan @coinbase.com menyang dhaptar Pangirim lan Domain sing Diblokir supaya tandha keamanan mumbul utawa pindhah menyang Junk kanthi meneng. Mbusak dhaptar Pangirim sing Diblokir saka perusahaan sing sah.
  3. ** Priksa Mail -> Forwarding and IMAP**:
    • Priksa manawa **Aktifake penerusan ** ora dicenthang. Yen alamat email panyerang wis lungguh ing kothak karo "Keep a copy of forwarded messages" ora dicenthang, saben email sing dikirim menyang sampeyan diterusake menyang peretas lan dibusak saka kothak layang sadurunge mlebu kothak mlebu.
  4. Kanggo Administrator Microsoft 365 Perusahaan: Jalanake PowerShell kanggo Mbukak Aturan MAPI / Korupsi Korupsi sing Didhelikake (MFCMAPI):
    • Aktor ancaman BEC canggih nggunakake Exchange Web Services (EWS) API utawa MFCMAPI kanggo nggawe aturan Inbox rusak sing didhelikake (kanthi ngudani PR_RULE_MSG_NAME lan PR_RULE_MSG_PROVIDER properti MAPI) sing ora katon ing Outlook Web GUI utawa Pusat Admin Exchange standar.
    • Administrator IT kudu nyambung menyang Exchange Online PowerShell lan mbukak: 
      Get-InboxRule -Mailbox victim@yourdomain.com -IncludeHidden | Format-List Name,Enabled,Description,ForwardTo,ForwardAsAttachmentTo,RedirectTo,DeleteMessage,MoveToFolder
    • Tambah -IncludeHidden gendera mbabarake aturan MAPI siluman sing didhelikake ing tabel Isi Gabungan kothak layang (FAI), sing banjur bisa diresiki liwat Remove-InboxRule -Mailbox victim@yourdomain.com -Identity "<RuleID>" utawa kanthi diluncurake outlook.exe /cleanrules.
    • Priksa uga Aturan Transportasi Exchange Tingkat Tenant (Aturan Aliran Surat) liwat Get-TransportRule: yen panyerang kompromi akun Exchange Administrator, bisa uga wis nggawe aturan aliran mail ing organisasi global tinimbang aturan kothak layang individu.

Warning

Napa panyerang isih mlebu ing emailku sawise ngganti tembung sandhi lan nguripake Otentikasi Loro-Faktor? Amarga Stolen Session Cookie Replay (Infostealer Malware) utawa Ekstensi Browser Angkoro. Yen sampeyan ndownload program bajakan, alat PDF/invoice palsu, codec video palsu, utawa ekstensi Chrome sing ala ing Windows PC utawa Mac, malware kasebut nyalin database SQLite Cookie sing wis didekripsi saka browser sampeyan (%LocalAppData%\Google\Chrome\User Data\Default\Network\Cookies). Kanthi ngimpor cookie menyang browser anti-deteksi, panyerang bakal ngliwati tembung sandhi lan 2FA. Yen sampeyan curiga ana malware ing komputer, deleng pandhuan kita ing malware, ransomware, lan infeksi spyware lan resik-instal maneh OS sadurunge mlebu maneh menyang email ing komputer kasebut.

Fase 2: Apa sing kudu ditindakake yen sampeyan wis dikunci kabeh (Penyerang ngganti tembung sandhi & 2FA)

Yen panyerang wis ngganti tembung sandhi, ngganti nomer telpon pemulihan nganggo nomer telpon dhewe, lan nguripake aplikasi Authenticator utawa tombol hardware dhewe, saben menit dianggep amarga panyerang aktif njarah akun sing disambung nalika sampeyan dikunci.

Langkah 1: Cut Off Leverage Keuangan Penyerang Pisanan (15 Menit pisanan)

Aja nglampahi telung jam kanggo nglawan formulir pemulihan email otomatis nalika peretas mbuwang akun bank sampeyan nggunakake kothak mlebu sing dibajak:

  1. Telpon Bank, Penerbit Kertu Kredit, lan Broker Investasi liwat Telpon:
    • Marang Departemen Penipuan: * "Alamat email utamaku [your@email.com] wis dikompromi lan saiki aku ora dikunci. Selehake sandi langsung / keamanan beku ing profilku, njabut sesi web/seluler sing aktif, lan mbusak alamat email kasebut saka reset tembung sandi layanan mandiri."*
  2. Kunci Akun Operator Ponsel Sampeyan Nglawan Pertukaran SIM Tindakake:
    • Ing kothak mlebu sing disusupi, panyerang bisa maca tagihan AT&T, Verizon, T-Mobile, Rogers, Vodafone, utawa O2 saben wulan, menehi nomer akun seluler lan alamat tagihan. Telpon operator sampeyan langsung kanggo verifikasi ** PIN Transfer Nomer / Port Freeze ** lan Kode Sandhi Akun dikunci.
  3. Bekukan Akun Exchange Cryptocurrency Panjenengan (Coinbase, Binance, Kraken, Gemini):
    • Umume ijol-ijolan utama nyedhiyakake telpon siji-klik utawa darurat Kunci Akun yen email sampeyan dikompromi (contone, nelpon kunci darurat otomatis Coinbase ing +1 (888) 908-7930 ing AS / International utawa +44 808 168 4635 ing Inggris).
  4. **Ganti Alamat Email Kadhaptar ing Saben Akun Sampeyan Isih Bisa Mlebet **:
    • Sampeyan bisa uga ** isih mlebu ** menyang Amazon, PayPal, Venmo, Steam, Discord, Apple ID, lan manajer sandhi ing aplikasi smartphone sampeyan saiki. Gawe akun email darurat sing anyar lan resik (contone, ing ProtonMail utawa Gmail anyar sing diamanake nganggo kunci hardware) lan langsung menyang setelan app aplikasi sing isih mlebu kanggo ngalih email kontak saka alamat sing disusupi sadurunge panyerang ngreset.

Langkah 2: Cara Pass Algoritma Pemulihan Akun Otomatis (Google, Microsoft, Yahoo)

Kanggo akun email konsumen gratis (@gmail.com, @outlook.com, @hotmail.com, @yahoo.com), agen dhukungan manungsa dilarang banget dening kontrol teknik ngreset sandhi kanthi manual utawa ngliwati 2FA liwat telpon (kanggo nyegah rekayasa sosial). Nanging, pemulihan diatur dening Mesin Skor Risiko & Identitas otomatis. Kanggo nggedhekake skor kapercayan kriptografi sampeyan lan micu "7-Dina / 30-Day Security Hold Override":

  1. ** ATURAN KRITIS: Kirim Formulir Pamulihan saka Piranti Sejarah, Browser, lan Alamat IP Wi-Fi Ngarep Sampeyan **:
    • Aja mlayu accounts.google.com/signin/recovery utawa account.live.com/acsr saka jendhela browser incognito anyar ing data seluler utawa liwat VPN.
    • Gunakake laptop, desktop, utawa smartphone sing tepat lan browser sing tepat (kanthi cookie utuh/panyimpenan lokal) ing ngendi sampeyan wis mlebu menyang akun email kasebut saben dina sajrone taun kepungkur, nalika nyambung menyang router Wi-Fi omah utawa kantor normal (ASN lan cocog geolokasi). Algoritma pemulihan nimbang banget token bekas driji piranti (DeviceID) lan subnet IP historis.
  2. Pamulihan Google / Gmail (accounts.google.com/signin/recovery):
    • Sanadyan panyerang ngganti telpon pemulihan lan email pemulihan sawetara detik kepungkur, Google nahan nomer telpon pemulihan sadurunge lan alamat email pemulihan sadurunge minangka faktor pemulihan sing bener sajrone persis 7 dina tanggalan (168 jam) sawise panyerang ngowahi.
    • Nalika dijaluk sak signin/recovery, klik "Coba cara liyane" nganti nawakake ngirim kode menyang asli nomer telpon utawa asli alamat email Recovery, utawa njaluk telpon Android / iPhone sing sadurunge kadhaptar liwat Google Prompt.
    • Yen Sampeyan Langganan Google One (Panyimpenan Cloud Berbayar) utawa YouTube Premium / Saluran YouTube:
      • Pelanggan Google One mbayar duwe akses menyang manungsa urip Dhukungan Google One (one.google.com/support) sing bisa nambah akun sing dikunci sacara internal.
      • Yen akun Google sampeyan sing disusupi duwe Saluran YouTube, hubungi @TeamYouTube ing X (biyen Twitter) langsung umum. Ora kaya Gmail standar, @TeamYouTube Dhukungan Pencipta nyedhiyakake Formulir Eskalasi Akun sing Disusupi khusus sing diuji coba dening insinyur kepercayaan lan keamanan Google manungsa sing verifikasi asli sampeyan Channel ID (UC..), ID AdSense, lan upload riwayat IP kanggo mbusak sandhi/MFA penyerang kanthi fisik lan mulihake kabeh akun Google/Gmail sampeyan sajrone 24 nganti 72 jam.
  3. Microsoft Outlook / Hotmail / Recovery Akun Xbox (account.live.com/acsr):
    • Pisanan, coba mlebu lan ngeklik "Aku ora duwe iki" ing layar 2FA: yen sampeyan duwe 25-karakter Microsoft Recovery Code sing disimpen nalika asline nyiyapake akun, ngetik ngidini sampeyan ngganti informasi keamanan panyerang (tundhuk prentah Microsoft **30-dina panggantos info keamanan wektu nunggu **, nalika akun panyerang uga bisa diblokir).
    • Nalika ngisi Formulir Pemulihan Akun Microsoft (account.live.com/acsr) saka IP Wi-Fi omah sampeyan:
      • Nyedhiyani baris Subyek sing tepat saka 3 nganti 4 email anyar sing dikirim (takon kanca utawa kulawarga kanggo ndeleng ing kothak mlebu dhewe lan maca baris Subyek karakter-kanggo-karakter saka email sing sampeyan kirim bubar).
      • Nyedhiyakake alamat email sing pas kanggo kontak sing bubar dikirim lewat email.
      • Nyedhiyani ** Xbox Console Hardware LiveDeviceID / Nomer Seri** yen sampeyan tau mlebu menyang Xbox nganggo akun Microsoft kasebut, lan 4 digit pungkasan lan tanggal kadaluwarsa kertu kredit apa wae sing digunakake ing Microsoft Store / Skype / Office 365.

Tip

Sawise sampeyan entuk akses maneh menyang akun email sing disusupi, ** priksa Sent folder lan Panjenengan Trash folder kanggo pemerasan utawa email scam sing dikirim dening panyerang menyang kontak sampeyan.** Penyerang asring mindhai kothak mlebu kanggo foto sensitif, dokumen pajak, utawa invoice bisnis, lan ngirim email palsu "kertu hadiah mendesak / transfer kabel" menyang kanca, wong tuwa, utawa klien. Kirimi email bebaya sing jelas (lan pesen teks) marang sapa wae sing dikirimi panyerang sajrone jendela pelanggaran.

Fase 3: Kontrol karusakan kanggo rahasia sing katon ing email lawas sampeyan

Sawise sampeyan wis ngunci panyerang metu lan ngresiki kabeh aturan lan token OAuth, sampeyan kudu ngadhepi kasunyatan forensik sing nyenengake: yen panyerang duwe akses IMAP, OAuth, utawa web menyang kothak layang nganti 15 menit, anggep yen dheweke wis mbukak telusuran tembung kunci otomatis ing kabeh arsip email riwayat sampeyan.

Penyerang ora maca 50.000 email lawas kanthi manual. Skrip otomatis kasebut langsung nelusuri kothak mlebu kanggo sepuluh tembung kunci sing nduweni nilai dhuwur lan download saben pesen sing cocog lan lampiran PDF:

  1. "seed", "mnemonic", "recovery phrase", "24 words", "wallet", "Coinbase", "Binance", "Ledger": Yen sampeyan nate ngirim foto, cathetan teks, utawa zip ndhelik saka tembung wiji cryptocurrency utawa kode serep 2FA kanthi email, anggep dompet kasebut langsung dikompromi lan pindhah kabeh dana menyang dompet hardware anyar.
  2. "tax", "1040", "W-2", "1099", "SSN", "Social Security", "passport", "driver license", "mortgage", "closing": Aplikasi silihan, sewa apartemen, lan email CPA ing kothak mlebu sampeyan meh mesthi ngemot PDF kanthi Nomer Keamanan Sosial (utawa ID nasional), tanggal lahir, lan foto SIM sing durung diedit. Selehake Pembekuan Kredit langsung nganggo Equifax, Experian, lan TransUnion (ndeleng pandhuan kita ing respon nyolong identitas).
  3. "password", "login", "credentials", "welcome to", "backup codes": Telusuri kothak mlebu sampeyan saiki kanggo tembung kasebut password lan backup code, mbusak email plaintext sing mbebayani sawise muter saben tembung sandhi sing kasebut ing.
  4. "invoice", "ACH", "wire", "routing", "escrow", "closing costs", "docusign": Yen sampeyan lagi tuku omah, mbayar kontraktor, utawa mbukak bisnis, penyerang saiki duwe salinan invoice nyata lan rincian rute perbankan lan bakal nyoba niru sampeyan utawa perusahaan judhul kanggo nyolong transfer kabel. Telpon perusahaan judhul real estate, pejabat escrow, utawa klien ing telpon langsung kanggo ngelingake.

Pitakonan sing kerep ditakoni

I changed my email password and turned on 2FA, yet the hacker is STILL sending emails from my account. How is that possible?

There are four technical mechanisms that survive a password change and 2FA setup: **1. Active Third-Party OAuth Tokens**: The hacker connected an OAuth application (like `eM Client`, `Thunderbird`, or a malicious script) to your account; OAuth tokens authenticate via API refresh tokens and never check your password again until you explicitly revoke the app at `myaccount.google.com/connections` or `account.live.com/consent/Manage`. **2. 16-Character App Passwords**: The hacker generated an IMAP/SMTP App Password in your security settings, which bypasses 2FA completely. **3. Mailbox Delegation**: In Gmail (`Settings -> Accounts and Import -> Grant access to your account`) or Microsoft 365 Exchange Delegation, the hacker added their own account as a delegate. **4. Infostealer Malware on Your PC**: Your computer has a trojan stealing the live session cookie from your web browser every time you log in with your new password.

Why am I suddenly receiving 500 to 5,000 random newsletter sign-up emails per hour ("Email Bombing")?

If your inbox suddenly explodes with thousands of automated *"Confirm your newsletter subscription"* emails in every language from random websites around the world, **you are under an active "Subscription Bomb" (Email Bombing) attack.** Do NOT bulk-delete your entire inbox without looking closely. Attackers launch a Subscription Bomb to bury **one specific, critical email** that arrived right at the start of the flood, such as an **Apple Store / Best Buy $3,000 laptop order confirmation**, a **Bank Wire Transfer alert**, a **Zelle / PayPal transfer receipt**, or a **Mobile Carrier SIM Swap notification**. Use your email search bar immediately to filter for: `subject:(order OR receipt OR wire OR transfer OR password OR security OR alert OR SIM)` or check your bank, credit card, Amazon, Walmart, and mobile carrier accounts right now to find the single fraudulent transaction they are trying to hide in the noise.

Can an attacker hack my email just by me opening and reading an email without clicking any links or downloading attachments?

In modern webmail (Gmail, Outlook Web, Yahoo, Apple Mail on updated iOS/macOS), simply opening and reading a plain text or HTML email does **not** hand over your password or infect your device, provided your operating system and browser are up to date. The only thing opening an email can reveal to a sender is a **Tracking Pixel** (an invisible 1x1 pixel external image that tells a spammer your email address is active and reveals the rough IP address of the mail proxy, though Apple Mail Privacy Protection and Gmail image proxies now mask even your real IP). Almost 100 percent of email takeovers come from **1. Credential Reuse** (reusing a password leaked in another website's data breach), **2. Adversary-in-the-Middle (AitM) Phishing Links** (clicking a fake login link), or **3. Infostealer Malware** executed on a PC.

Why did I get an email from MY OWN email address saying a hacker recorded me through my webcam (`Pegasus` / Trojan extortion email)?

If you received an email that appears to be sent **`From: your_own_email@domain.com` `To: your_own_email@domain.com`** claiming a hacker installed "Pegasus spyware" or recorded you via your webcam while browsing adult websites and demanding $500 to $2,000 in Bitcoin, **your email and computer were NOT hacked.** This is a mass-automated **SMTP Header Spoofing scam**. Basic email protocols allow any spam server to type your address into the visual `From:` display header (just like writing a fake return address on a paper envelope). If you check your **`Sent`** folder, you will see that email is not in your `Sent` folder, and if you click **"Show Original" / "View Message Source"**, you will see `SPF: FAIL` or `DMARC: FAIL` from a foreign server IP. Delete the email and never pay.

What is the safest type of Two-Factor Authentication (2FA) to put on my email so it can never be phished or SIM-swapped?

Move away from **SMS Text Message 2FA** (which can be stolen via a SIM swap) and even standard 6-digit TOTP Authenticator codes (which can be intercepted in real time if you accidentally type them into an Adversary-in-the-Middle `Evilginx` phishing page). Instead, enable **FIDO2 / WebAuthn Passkeys or Physical Hardware Security Keys (such as a YubiKey 5 Series or Google Titan Key)**. Because FIDO2 cryptographic signatures are mathematically bound to the genuine browser domain (`google.com` or `login.live.com`), a FIDO2 hardware key or passkey makes it cryptographically impossible for an attacker to phish your login, even if you click a sophisticated fake login link. Enroll at least **two** hardware keys (one primary on your keychain, one backup in a fireproof safe) and enable **Google Advanced Protection Program (`landing.google.com/advancedprotection`)** if you are a high-risk target.

Should I permanently abandon my old email address after a hack and create a brand-new one?

If you thoroughly purge all 6 persistence points (Recovery info, Active sessions, App Passwords, OAuth grants, Filters/Forwarding rules, and Delegation) and lock the account with a strong unique password and FIDO2 MFA, **the technical security of the account is 100 percent restored.** However, you should still ** keep the old email account open and locked down forever** rather than deleting it. If you delete an old `@outlook.com`, `@yahoo.com`, or custom domain email address, an attacker may eventually re-register that recycled username and use it to reset forgotten accounts tied to it. Many security professionals keep their old address locked with a hardware key as a decoy/legacy inbox while migrating their **banking, brokerage, tax, and cryptocurrency logins** to a brand-new, private, unpublicized email address (`myname-vault@proton.me` or a dedicated Gmail) that is never given out on shopping sites, newsletters, or social media.

Sumber dicenthang

  • Badan Keamanan Siber lan Infrastruktur (CISA, Amerika Serikat): Protecting Against Business Email Compromise (BEC), Penyalahgunaan Aplikasi OAuth, lan Pandhuan MFA sing Tahan Phishing (cisa.gov/MFA lan cisa.gov).
  • Pusat Tanggepan Keamanan Microsoft & Intelijen Ancaman Defender (Amerika Serikat): Nanggapi Akun Email sing Dikompromi ing Microsoft Defender kanggo Office 365 (Aturan Kothak Masuk sing Didhelikake -IncludeHidden, Hibah Idin OAuth, lan Pembatalan Sesi) (learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account).
  • Bantuan Admin Keamanan Akun Google & Workspace (Amerika Serikat): Ngamanake Akun Google sing Disusupi utawa Disusupi, Sambungan Pihak Ketiga OAuth, lan Program Perlindhungan Lanjut (support.google.com/accounts/answer/6294825).
  • Pusat Keamanan Siber Nasional (NCSC, Inggris): Mulihake Akun Email sing Dikompromi lan Ngilangi Kekuwatan Aturan Penerusan Email (ncsc.gov.uk).
  • Komisi Perdagangan Federal (FTC, Amerika Serikat): Apa sing kudu ditindakake yen Akun Email Sampeyan Disusupi (consumer.ftc.gov).
  • Pusat Keamanan Siber Australia (ACSC / ASD, Australia): Njaga Akun Email lan Ndeteksi Aturan Kothak Ora Sah (cyber.gov.au).

Pandhuan sing gegandhengan