ບັນຊີອີເມວທີ່ຖືກແຮັກ: ກົດລະບຽບການສົ່ງຕໍ່ທີ່ເຊື່ອງໄວ້ ແລະການຟື້ນຟູ¶

Your primary email account is the skeleton key to your entire digital, financial, and legal identity. Unlike a compromised social media profile or streaming login, a hacked Gmail, Microsoft Outlook / Microsoft 365, Yahoo, Apple iCloud Mail, or ProtonMail account gives an attacker the power to click "Forgot Password" on your bank accounts, cryptocurrency exchanges, retirement brokerages, tax portals, and cloud drives. Most dangerously, merely changing your email password and turning on Two-Factor Authentication (2FA) rarely kicks a sophisticated attacker out of a hacked inbox. Within 30 seconds of breaking into an email account, modern attackers plant five layers of silent persistence backdoors: hidden Inbox Sweep and Forwarding Rules (often named ., .., or [Blank] that silently move password-reset emails straight to the Trash ຫຼື RSS Feeds folder so you never see them), Third-Party OAuth Application Grants (eM Client, Thunderbird, or fake Google Docs apps that retain full API read/write access without needing your password), Delegated Mailbox Permissions, App Passwords (IMAP/SMTP), and Recovery Email / Phone Number swaps.

If an email compromise involves immediate threats of physical violence, stalking, domestic abuse, or extortion against a minor, call your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom) or consult our directory of international ຕົວເລກສຸກເສີນ right away. For all consumer and corporate inbox takeovers, execute the 6-step eradication sequence below in exact order.

ເຮັດອັນນີ້ດຽວນີ້¶

1. Do NOT change your password from the same Windows PC or Mac if you suspect an Infostealer virus: If your email was hacked even though you already had Two-Factor Authentication (2FA) turned on, your computer likely has an Infostealer malware infection (such as Lumma Stealer, RedLine, or Atomic macOS Stealer) or a malicious Chrome/Edge extension that steals live authenticated browser session cookies (SAPISID/SID on Google or ESTSAUTH on Microsoft). Pick up a clean smartphone (iOS or Android) to perform your password change and security cleanup right now.
2. Audit and revert your Account Recovery Email, Recovery Phone Number, and MFA Authenticator devices BEFORE changing your password (or within 30 seconds after): Attackers immediately add their own burner phone number, disposable email address, or rogue Authenticator app to your security settings. If you change your password without deleting the attacker's recovery phone or rogue passkey, the attacker will simply click "Forgot Password" 10 seconds later and lock you out permanently.
3. Force-terminate all active login sessions, persistent browser cookies, and App Passwords globally: Changing a password does not always immediately kill existing mobile IMAP tokens or active web session cookies. Explicitly click "Sign out of all devices / Revoke all sessions" in your Google, Microsoft, Yahoo, or Apple security dashboard, and delete every 16-character App Password on the account.
4. Open a desktop web browser (not a mobile mail app) and delete all hidden Inbox Rules, Filters, Auto-Forwarders, and Sweep Rules: Mobile mail apps (Gmail ຫຼື Outlook on iOS/Android) frequently hide advanced server-side routing rules. Open your webmail settings in a desktop browser and inspect Filters and Blocked Addresses, Forwarding and POP/IMAP, and Rules / Sweep. Delete any rule that forwards mail externally or automatically moves emails containing words like "bank", "code", "reset", "security", "wire", "invoice", or "crypto" into the Trash, Archive, or RSS Feeds folder.
5. Revoke all Third-Party OAuth Connected Apps and Mailbox Delegates: Navigate to your account's Third-Party Apps & Services (Google) or Apps and Services you've given access (Microsoft/Yahoo) and revoke every single app with Mail.Read, Mail.ReadWrite, or Gmail API permissions, plus check Grant Access to Your Account (Delegation) so the attacker cannot read your inbox through an OAuth token that completely ignores password changes.
6. Check your Trash (Bin), Sent, ແລະ Spam folders immediately to see which financial or crypto accounts the attacker already reset: Attackers delete incoming security alerts from your bank, Coinbase/Binance, Amazon, PayPal, or Steam seconds after receiving the 6-digit verification code. Open your Trash ແລະ Sent folders right now: every password-reset email sitting in your Trash is an account the attacker has already breached or attempted to breach.

Decision tree: regaining control and purging persistence backdoors¶

Follow this step-by-step triage tree whether you still have access to your inbox or have been completely locked out by the attacker:

flowchart TD
    A["Suspected or Confirmed Email Account Compromise"] --> B{"Can you still log into your email account right now?"}
    B -->|"Yes: I still have access"| C["Switch to a Clean Smartphone (Avoid Potentially Infected PC)"]
    C --> D["1. Remove Attacker's Recovery Phone, Recovery Email & Rogue MFA Passkeys"]
    D --> E["2. Change Password to Unique 20+ Char Passphrase & Enable Phishing-Resistant 2FA"]
    E --> F["3. Click 'Sign Out of All Devices' & Delete All 16-Char App Passwords"]
    F --> G["4. Open Desktop Webmail: Purge Hidden Forwarding, Filters, Sweep Rules & Delegates"]
    G --> H["5. Revoke OAuth Third-Party Apps & Inspect Trash/Sent Folders for Breached External Accounts"]
    B -->|"No: Attacker changed password and recovery phone/MFA"| I{"What type of email account is locked?"}
    I -->|"Work / School / Corporate Domain (@company.com)"| J["Contact IT Admin Immediately: Admin Can Reset MFA, Revoke Tokens & Restore Access in 60 Seconds via Admin Console"]
    I -->|"Personal Gmail / Outlook.com / Yahoo / iCloud"| K["Run Automated Account Recovery Form from Your Historical Home Wi-Fi IP and Familiar Browser/Phone"]
    K --> L["Immediately Call Your Banks, Mobile Carrier & Crypto Exchanges by Phone to Freeze Accounts Tied to That Email"]

Phase 1: Deep-clean persistence audit by email provider (Gmail, Outlook/M365, Yahoo, iCloud)¶

Every major email provider stores forwarding rules, filters, OAuth tokens, and mailbox delegates in slightly different menus. Even if you use Apple Mail or Outlook Desktop on your computer, you must log into the provider's official webmail interface in a desktop browser (or request the "Desktop Site" in your mobile browser) to see these server-side settings.

ຂັ້ນຕອນລະອຽດ 1: ການລຶບບັນຊີ Google / Gmail ທີ່ຖືກແຮັກ¶

ໃນເວລາທໍາຄວາມສະອາດບັນຊີ Gmail ຫຼື Google Workspace ທີ່ຖືກເຄາະຮ້າຍ, ເຮັດວຽກຜ່ານເຈັດແຖບທີ່ແນ່ນອນເຫຼົ່ານີ້ໂດຍບໍ່ຕ້ອງຂ້າມແຖບດຽວ:

1. ** ການ​ກວດ​ສອບ​ຄວາມ​ປອດ​ໄພ​ແລະ Passkeys (myaccount.google.com/security)**:
   • ຄລິກ ລະ​ຫັດ​ຜ່ານ​ແລະ​ກະ​ແຈ​ຄວາມ​ປອດ​ໄພ: ຜູ້​ໂຈມ​ຕີ​ໄດ້​ລົງ​ທະ​ບຽນ​ລະ​ຫັດ​ຜ່ານ​ຊິງ​ຄ໌​ຫຼື virtual authenticator ໃນ​ຕົວ​ທ່ອງ​ເວັບ​ຂອງ​ຕົນ​ເອງ​ເພື່ອ​ໃຫ້​ເຂົາ​ເຈົ້າ​ສາ​ມາດ​ເຂົ້າ​ສູ່​ລະ​ບົບ​ກັບ​ຄືນ​ໄປ​ບ່ອນ​ດ້ວຍ​ລະ​ຫັດ​ຜ່ານ​ສູນ​ແລະ​ສູນ SMS prompt. ລຶບລະຫັດຜ່ານໃດໆທີ່ທ່ານບໍ່ຮັບຮູ້ດ້ວຍຄວາມແນ່ນອນ 100 ເປີເຊັນ.
   • ຄລິກ ການພິສູດຢືນຢັນແບບ 2 ຂັ້ນຕອນ -> ກວດເບິ່ງ Authenticator, Google Prompt devices, Recovery phone, ແລະ Backup codes. ຄລິກ ສ້າງລະຫັດໃໝ່ ເພື່ອຍົກເລີກລະຫັດສຳຮອງ 8 ຕົວເລກທີ່ຜູ້ໂຈມຕີໄດ້ screenshot ໄວ້ໃນທັນທີ.
2. ** ທໍາລາຍລະຫັດຜ່ານຂອງແອັບຯທີ່ໃຊ້ວຽກ (myaccount.google.com/apppasswords)**:
   • ** ລະຫັດຜ່ານແອັບ** ເປັນລະຫັດ 16 ຕົວອັກສອນທີ່ຊ່ວຍໃຫ້ລູກຄ້າອີເມວ IMAP (ເຊັ່ນ: Thunderbird ຫຼືສະຄຣິບ Python ຂອງແຮກເກີ) ດາວໂຫຼດກ່ອງຈົດໝາຍທັງໝົດຂອງເຈົ້າຕະຫຼອດໄປ ** ໃນຂະນະທີ່ຂ້າມຜ່ານການກວດສອບ 2 ຂັ້ນຕອນ **. ລຶບລະຫັດຜ່ານແອັບຯທຸກລາຍການ.
3. ** ຖອນການເຊື່ອມຕໍ່ OAuth ພາກສ່ວນທີສາມ (myaccount.google.com/connections)**:
   • Look for any application granted access to Gmail, Google Drive, or Google Contacts (attackers often use legitimate-looking mail clients like eM Client, Newton Mail, Cleanfox, or custom OAuth scripts). Click the app -> Delete all connections you have with [App Name].
4. Check Gmail Accounts and Import Tab (Mail Delegation & Reply-To Hijacking):
   • In Gmail on a desktop computer, click the Gear icon -> See all settings -> Accounts and Import.
   • Under Grant access to your account, verify that ZERO email addresses are listed. A delegated user can read, send, and delete your emails without knowing your password.
   • Under Send mail as, click edit info next to your own name and verify the attacker did not insert a secret Specify a different "reply-to" address (for example, setting your Reply-To to yourname.company@gmail.com or an attacker lookalike domain so that whenever someone replies to your legitimate emails, their reply goes to the hacker instead of you).
5. Check Gmail Filters and Blocked Addresses Tab:
   • Look closely at every filter. Attackers often create filters matching from:(a|e|i|o|u) ຫຼື size > 0 ຫຼື has:attachment or keywords like invoice, wire, bank, security, alert, code with the action Skip the Inbox (Archive it), Mark as read, Delete it, or Forward it to:. Delete every unfamiliar filter.
6. Check Gmail Forwarding and POP/IMAP Tab:
   • Verify Forwarding is set to Disable forwarding, remove any unrecognized forwarding address from the dropdown list, and set IMAP access to Disable IMAP (unless you specifically use a secure desktop client).
7. Check Google Drive Trash & Google Takeout History:
   • Attackers frequently trigger a Google Takeout (takeout.google.com) archive to download a .zip of all your emails, Google Photos, and Google Drive documents, including tax returns and password lists. Visit takeout.google.com right now: if you see an active or completed export you did not request, click Cancel export and see exactly which data categories were packaged.

Detailed Walkthrough 2: Purging a Hacked Microsoft Outlook.com / Hotmail / Microsoft 365 Account¶

Microsoft accounts (@outlook.com, @hotmail.com, @live.com, @msn.com, and corporate Microsoft 365 Exchange Online mailboxes) have several unique hiding spots that attackers exploit during Business Email Compromise (BEC) and consumer hacks:

1. The Hidden RSS Feeds ແລະ Conversation History Folder Trap:
   • In Outlook, attackers rarely route suppressed emails into the main Deleted Items folder because users check Deleted Items. Instead, they create an Outlook Rule named . ຫຼື 1 that moves incoming emails into the RSS Feeds, Archive, or Conversation History folder and marks them as read. Check every folder in your left sidebar, especially RSS Feeds, right now.
2. Audit Both Rules AND Sweep in Outlook Web (outlook.live.com ຫຼື outlook.office.com):
   • Click the Settings Gear (top right) -> Mail -> Rules. Delete any rule you did not create.
   • Notice the checkbox at the bottom of an attacker's rule: Stop processing more rules. Attackers check this box on their top rule so none of your legitimate rules run.
   • Next, click Mail -> Sweep and Mail -> Junk email -> Blocked senders and domains. Attackers routinely add @microsoft.com, @google.com, @apple.com, @chase.com, @bankofamerica.com, ແລະ @coinbase.com to your Blocked Senders and Domains list so security alerts bounce or go silently to Junk. Clear your Blocked Senders list of any legitimate companies.
3. Check Mail -> Forwarding and IMAP:
   • Ensure Enable forwarding is unchecked. If an attacker's email address is sitting in the box with "Keep a copy of forwarded messages" unchecked, every email sent to you was being forwarded to the hacker and deleted from your mailbox before it ever hit your Inbox.
4. For Corporate Microsoft 365 Administrators: Run PowerShell to Uncover Hidden MAPI / Corrupt Inbox Rules (MFCMAPI):
   • Sophisticated BEC threat actors use the Exchange Web Services (EWS) API or MFCMAPI to create hidden corrupted Inbox rules (by stripping the PR_RULE_MSG_NAME ແລະ PR_RULE_MSG_PROVIDER MAPI properties) that do not show up at all in the Outlook Web GUI or standard Exchange Admin Center.
   • An IT Administrator should connect to Exchange Online PowerShell and run:

     Get-InboxRule -Mailbox victim@yourdomain.com -IncludeHidden | Format-List Name,Enabled,Description,ForwardTo,ForwardAsAttachmentTo,RedirectTo,DeleteMessage,MoveToFolder
     

   • Adding the -IncludeHidden flag exposes stealth MAPI rules hiding in the mailbox's Associated Contents table (FAI), which can then be purged via Remove-InboxRule -Mailbox victim@yourdomain.com -Identity "<RuleID>" or by launching outlook.exe /cleanrules.
   • Also inspect Tenant-Level Exchange Transport Rules (Mail Flow Rules) via Get-TransportRule: if the attacker compromised an Exchange Administrator account, they may have created a global organization-wide mail flow rule rather than an individual mailbox rule.

Phase 2: What to do if you are completely locked out (Attacker changed password & 2FA)¶

If the attacker already changed your password, replaced your recovery phone number with their own, and turned on their own Authenticator app or hardware key, every minute counts because the attacker is actively looting your linked accounts while you are locked out.

Step 1: Cut Off the Attacker's Financial Leverage First (First 15 Minutes)¶

Do not spend three hours fighting an automated email recovery form while the hacker drains your bank account using your hijacked inbox:

1. Call Your Banks, Credit Card Issuers, and Investment Brokerages by Telephone:
   • Tell the Fraud Department: "My primary email address [your@email.com] has been compromised and I am currently locked out of it. Place an immediate verbal password / security freeze on my profile, revoke active web/mobile sessions, and remove that email address from self-service password resets."
2. Lock Your Mobile Phone Carrier Account Against a Follow-On SIM Swap:
   • Inside your hacked inbox, the attacker can read your monthly AT&T, Verizon, T-Mobile, Rogers, Vodafone, or O2 bills, giving them your mobile account number and billing address. Call your carrier immediately to verify your Number Transfer PIN / Port Freeze and Account Passcode are locked down.
3. Freeze Your Cryptocurrency Exchange Accounts (Coinbase, Binance, Kraken, Gemini):
   • Most major exchanges provide a one-click or emergency phone Account Lock if your email is compromised (for example, calling Coinbase automated emergency lock at +1 (888) 908-7930 in the US/International or +44 808 168 4635 in the UK).
4. Change the Registered Email Address on Every Account You Can Still Log Into:
   • You are likely still logged in to Amazon, PayPal, Venmo, Steam, Discord, Apple ID, and your password manager on your smartphone app right now. Create a brand-new, clean emergency email account (for example, on ProtonMail or a fresh Gmail secured with a hardware key) and immediately go into the app settings of your still-logged-in apps to switch their contact email away from the hacked address before the attacker resets them.

Step 2: How to Pass the Automated Account Recovery Algorithms (Google, Microsoft, Yahoo)¶

For free consumer email accounts (@gmail.com, @outlook.com, @hotmail.com, @yahoo.com), human support agents are strictly prohibited by engineering controls from manually resetting passwords or bypassing 2FA over the phone (to prevent social engineering). Instead, recovery is governed by an automated Risk & Identity Scoring Engine. To maximize your cryptographic trust score and trigger the hidden "7-Day / 30-Day Security Hold Override":

1. CRITICAL RULE: Submit the Recovery Form from Your Exact Historical Device, Browser, and Home Wi-Fi IP Address:
   • Never run accounts.google.com/signin/recovery ຫຼື account.live.com/acsr from a brand-new incognito browser window on cellular data or through a VPN.
   • Use the exact laptop, desktop, or smartphone and the exact browser (with intact cookies/local storage) where you have logged into that email account every day for the past year, while connected to your normal home or office Wi-Fi router (ASN and geolocation match). The recovery algorithm heavily weights device fingerprint tokens (DeviceID) and historical IP subnets.
2. Google / Gmail Recovery (accounts.google.com/signin/recovery):
   • Even if the attacker changed your recovery phone and recovery email seconds ago, Google retains your PREVIOUS recovery phone number and PREVIOUS recovery email address as valid recovery factors for exactly 7 calendar days (168 hours) after an attacker modifies them.
   • When prompted during signin/recovery, click "Try another way" until it offers to send a code to your original phone number or original recovery email address, or prompts your previously registered Android phone/iPhone via Google Prompt.
   • If You Subscribe to Google One (Paid Cloud Storage) or YouTube Premium / YouTube Channel:
     • Paid Google One subscribers have access to live human Google One Support (one.google.com/support) who can escalate locked accounts internally.
     • If your hacked Google account owns a YouTube Channel, contact @TeamYouTube on X (formerly Twitter) publicly right away. Unlike standard Gmail, @TeamYouTube Creator Support provides a dedicated Hacked Account Escalation Form piloted by human Google trust-and-safety engineers who verify your original Channel ID (UC..), AdSense ID, and upload IP history to physically strip the attacker's passkeys/MFA and restore your entire Google/Gmail account within 24 to 72 hours.
3. Microsoft Outlook / Hotmail / Xbox Account Recovery (account.live.com/acsr):
   • First, try logging in and clicking "I don't have any of these" at the 2FA screen: if you have a 25-character Microsoft Recovery Code saved when you originally set up your account, entering it lets you replace the attacker's security info (subject to Microsoft's mandatory 30-day security info replacement waiting period, during which the attacker can also be blocked if you flag the account).
   • When filling out the Microsoft Account Recovery Form (account.live.com/acsr) from your home Wi-Fi IP:
     • Provide the exact Subject lines of 3 to 4 recent emails you sent (ask friends or family to look in their own inbox and read you the exact character-for-character Subject lines of emails you sent them recently).
     • Provide the exact email addresses of contacts you recently emailed.
     • Provide your Xbox Console Hardware LiveDeviceID / Serial Number if you ever signed into an Xbox with that Microsoft account, and the last 4 digits and expiration date of any credit card ever used on Microsoft Store / Skype / Office 365.

Phase 3: Damage control for secrets exposed inside your old emails¶

Once you have locked the attacker out and cleaned all rules and OAuth tokens, you must confront a sobering forensic reality: if the attacker had IMAP, OAuth, or web access to your mailbox for even 15 minutes, assume they ran an automated keyword search across your entire historical email archive.

Attackers do not read your 50,000 old emails manually. Their automated scripts immediately search your inbox for these exact ten high-value keywords and download every matching message and PDF attachment:

1. "seed", "mnemonic", "recovery phrase", "24 words", "wallet", "Coinbase", "Binance", "Ledger": If you ever emailed yourself a photo, text note, or encrypted zip of a cryptocurrency seed phrase or 2FA backup code, consider that wallet compromised immediately and move all funds to a brand-new hardware wallet.
2. "tax", "1040", "W-2", "1099", "SSN", "Social Security", "passport", "driver license", "mortgage", "closing": Loan applications, apartment leases, and CPA emails inside your inbox almost certainly contain PDFs with your unredacted Social Security Number (or national ID), date of birth, and driver's license photo. Place an immediate Credit Freeze with Equifax, Experian, and TransUnion (see our guide on identity theft response).
3. "password", "login", "credentials", "welcome to", "backup codes": Search your own inbox right now for the words password ແລະ backup code, delete those dangerous plaintext emails after rotating every single password mentioned in them.
4. "invoice", "ACH", "wire", "routing", "escrow", "closing costs", "docusign": If you are in the middle of buying a house, paying a contractor, or running a business, the attacker now has copies of your real invoices and banking routing details and will attempt to impersonate you or your title company to steal the wire transfer. Call your real estate title company, escrow officer, or clients on the telephone immediately to warn them.

ຄຳຖາມທີ່ມັກຖາມເລື້ອຍໆ¶

ກວດສອບແຫຼ່ງທີ່ມາ¶

• Cybersecurity and Infrastructure Security Agency (CISA, United States): Protecting Against Business Email Compromise (BEC), OAuth Application Abuse, and Phishing-Resistant MFA Guidance (cisa.gov/MFA ແລະ cisa.gov).
• Microsoft Security Response Center & Defender Threat Intelligence (United States): Responding to a Compromised Email Account in Microsoft Defender for Office 365 (Hidden Inbox Rules -IncludeHidden, OAuth Consent Grants, and Session Revocation) (learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account).
• Google Account Security & Workspace Admin Help (United States): Secure a Hacked or Compromised Google Account, OAuth Third-Party Connections, and Advanced Protection Program (support.google.com/accounts/answer/6294825).
• National Cyber Security Centre (NCSC, United Kingdom): Recovering a Compromised Email Account and Mitigating Email Forwarding Rule Persistence (ncsc.gov.uk).
• Federal Trade Commission (FTC, United States): What To Do if Your Email Account Is Hacked (consumer.ftc.gov).
• Australian Cyber Security Centre (ACSC / ASD, Australia): Protecting Email Accounts and Detecting Unauthorized Inbox Rules (cyber.gov.au).

ຄູ່ມືທີ່ກ່ຽວຂ້ອງ¶

• ການຫຼອກເອົາຂໍ້ມູນ ແລະບັນຊີທີ່ຖືກລະເມີດ
• MFA phishing and adversary-in-the-middle bypass
• MFA lockout and authenticator recovery
• ການຕອບໂຕ້ການລະເມີດຂໍ້ມູນແລະການຮົ່ວໄຫລຂອງລະຫັດຜ່ານ
• Malware, ransomware, ແລະການຕິດເຊື້ອ spyware
• SIM swapping