Akaunti ya imelo yobedwa: malamulo obisika otumizira ndikuchira¶

Akaunti yanu yayikulu ya imelo ndiye chinsinsi cha chizindikiritso chanu chonse cha digito, zachuma, komanso zamalamulo. Mosiyana ndi mbiri yapa TV yomwe yasokonezedwa kapena kulowetsamo, Gmail, Microsoft Outlook / Microsoft 365, Yahoo, Apple iCloud Mail, kapena akaunti ya ProtonMail imapatsa wowukira mphamvu yakudina "Mwayiwala Mawu Achinsinsi" pamaakaunti anu aku banki, kusinthanitsa kwa cryptocurrency, mabizinesi opuma pantchito, zipata zamisonkho, ndi ma drive amtambo. Choopsa kwambiri, kungosintha mawu anu achinsinsi a imelo ndikuyatsa Kutsimikizika kwa Zinthu ziwiri (2FA) sikumathamangitsa wowukira wovuta kwambiri kuti atuluke mubokosi lolowera. Pakadutsa masekondi 30 mutalowa muakaunti ya imelo, owukira amakono amabzala zigawo zisanu za kuseri kwa zii: zobisika Sesani ndi Kutumiza Malamulo (Mabokosi Obwera Setani ndi Kutumiza Malamulo**) ., .., kapena [Blank] zomwe zimasuntha mwakachetechete maimelo osintha achinsinsi kupita ku Trash kapena RSS Feeds foda kuti musawawone), ** Ndalama Zothandizira za OAuth za Gulu Lachitatu ** (eM Client, Thunderbird, kapena zabodza Google Docs mapulogalamu omwe amakhalabe ndi mwayi wowerengera/kulemba wa API wonse osafuna mawu achinsinsi), Zilolezo Zoperekedwa ndi Bokosi Lamakalata, Machinsinsi a App (IMAP/SMTP), ndi Imelo Yobwezeretsa / Nambala Yafoni yosinthana.

Ngati kulolerana ndi imelo kumaphatikizapo kuwopseza nkhanza, kuzemberana, kuzunzidwa m'banja, kapena kulanda mwana, imbani nambala yanu yadzidzidzi yakuderalo (911 ku United States ndi Canada, 112 ku European Union, 999 ku United Kingdom) kapena fufuzani chikwatu chathu chapadziko lonse lapansi manambala angozi nthawi yomweyo. Pazolanda zonse za ogula ndi ma inbox, tsatirani masitepe 6 omwe ali m'munsimu motsatira ndondomeko yake.

Chitani izi tsopano¶

1. OSATI kusintha mawu anu achinsinsi kuchokera pa Windows PC kapena Mac yomweyo ngati mukukayikira kuti muli ndi kachilombo ka Infostealer: Ngati imelo yanu idabedwa ngakhale mudayatsidwa kale ndi Two-Factor Authentication (2FA), kompyuta yanu mwina ili ndi Infostealer malware (monga Lumma Stealer, RedLine, kapena Atomic macOS Stealer) kapena kutsimikizira gawo lachiwopsezo la ChromeSAPISID/SID pa Google kapena ESTSAUTH pa Microsoft). Tengani foni yam'manja yoyera (iOS kapena Android) kuti musinthe mawu anu achinsinsi ndikuyeretsa chitetezo pompano.
2. Unikani ndi kubweza Imelo Yanu Yobwezeretsa Akaunti, Nambala Yafoni Yobwezeretsa, ndi Zida Zotsimikizira MFA MUSANASINTHE mawu achinsinsi anu (kapena pasanathe masekondi 30): Zigawenga nthawi yomweyo amawonjezera nambala yawo ya foni, adilesi ya imelo yotayidwa, kapena pulogalamu yachinyengo ya Authenticator pazokonda zanu zachitetezo. Ngati musintha mawu anu achinsinsi osachotsa foni ya woukirayo kapena chiphaso choyipa, wowukirayo amangodina "Mwayiwala Achinsinsi" masekondi 10 kenako ndikutseka * inu * kunja kwamuyaya.
3. Imitsani magawo onse olowera, ma cookie osakhazikika, ndi Mawu Achinsinsi a App padziko lonse lapansi: Kusintha mawu achinsinsi sikumapha nthawi yomweyo ma tokeni a IMAP a m'manja kapena makeke agawo la intaneti. Dinani mwatsatanetsatane "Tulukani pazida zonse / Chotsani magawo onse" mu Google, Microsoft, Yahoo, kapena Apple chitetezo dashboard, ndipo chotsani zilembo 16 zilizonse Mawu Achinsinsi a App pa akaunti.
4. Tsegulani msakatuli wapakompyuta (osati pulogalamu yam'manja yam'manja) ndikuchotsa Malamulo onse obisika a Ma Inbox, Zosefera, Ma Auto-Forwarders, ndi Malamulo Osesa: Mapulogalamu amakalata am'manja (Gmail kapena Outlook pa iOS/Android) nthawi zambiri amabisa malamulo apamwamba apambali a seva. Tsegulani makonda anu atsamba lawebusayiti mumsakatuli wapakompyuta ndikuwona Zosefera ndi Maadiresi Oletsedwa, Kutumiza ndi POP/IMAP, ndi Malamulo / Sesani. Chotsani lamulo lililonse lotumiza maimelo kunja kapena kusuntha maimelo omwe ali ndi mawu ngati "bank", "code", "reset", "security", "wire", "invoice", kapena "crypto" ku Trash, Archive, kapena RSS Feeds chikwatu.
5. Chotsani Mapulogalamu Onse Olumikizidwa ndi OAuth a Gulu Lachitatu ndi Nthumwi za Mabokosi: Pitani ku akaunti yanu Mapulogalamu ndi Ntchito Zachipani Chachitatu (Google) kapena Mapulogalamu ndi Ntchito zomwe mwapereka (Microsoft/Yahoo) ndikuchotsa pulogalamu iliyonse yomwe muli nayo. Mail.Read, Mail.ReadWrite, kapena Gmail API zilolezo, kuphatikizanso fufuzani Perekani Kufikira ku Akaunti Yanu (Kutumiza) kuti woukirayo asathe kuwerenga bokosi lanu kudzera mu chizindikiro cha OAuth chomwe chimanyalanyaza kusintha mawu achinsinsi.
6. ** Onani wanu Trash (Bin), Sent,ndi Spam zikwatu nthawi yomweyo kuti muwone maakaunti azachuma kapena ma crypto omwe wowukirayo adakonzanso kale **: Owukira amachotsa zidziwitso zomwe zikubwera kuchokera kubanki yanu, Coinbase/Binance, Amazon, PayPal, kapena Steam masekondi mutalandira nambala yotsimikizira manambala 6. Tsegulani yanu Trash ndi Sent zikwatu pakali pano: imelo iliyonse yokhazikitsira mawu achinsinsi yomwe ili mkati mwanu Trash ndi akaunti yomwe wowukirayo adaphwanya kale kapena kuyesa kuphwanya.

Mtengo wachigamulo: kubwezeretsanso kuwongolera ndikuyeretsa kulimbikira kumbuyo¶

Tsatirani mtengo wotsatirawu pang'onopang'ono ngakhale mumapezabe ma inbox kapena mwatsekeredwa kunja ndi wowukirayo:

flowchart TD
    A["Kukayikiridwa kapena Kutsimikizika kwa Akaunti ya Imelo ya Imelo"] --> B{"Kodi mungalowebe muakaunti yanu ya imelo pompano?"}
    B -->|"Inde: ndikadali ndi mwayi"| C["Sinthani ku Smartphone Yoyera (Pewani PC Yoti Mungakhale ndi Matenda)"]
    C --> D["1. Chotsani Attacker's Recovery Phone, Recovery Email & Rogue MFA Passkeys"]
    D --> E["2. Sinthani mawu achinsinsi kukhala mawu achinsinsi a 20+ ndi Yambitsani Phishing-Resistant 2FA"]
    E --> F["3. Dinani 'Tulukani Pazida Zonse' & Chotsani Ma Password Onse a 16-Char App"]
    F --> G["4. Tsegulani Tsamba Lapaintaneti Lapakompyuta: Chotsani Kutumiza Zobisika, Zosefera, Sesani Malamulo & Nthumwi"]
    G --> H["5. Chotsani Mapulogalamu a OAuth Achipani Chachitatu & Yang'anani Zinyalala/Mafoda Otumizidwa a Maakaunti Akunja Ophwanyidwa"]
    B -->|"Ayi: Wowononga adasintha mawu achinsinsi ndi foni yochira / MFA"| I{"Ndi akaunti yanji ya imelo yomwe yatsekedwa?"}
    I -->|"Ntchito / Sukulu / Dongosolo Lamakampani (@company.com)"| J["Lumikizanani ndi IT Admin Nthawi yomweyo: Admin Atha Kukonzanso MFA, Kubweza Zizindikiro & Kubwezeretsanso Kufikira mu Sekondi 60 kudzera pa Admin Console"]
    I -->|"Personal Gmail / Outlook.com / Yahoo / iCloud"| K["Thamangani Fomu Yobwezeretsa Akaunti Yokha kuchokera ku Mbiri Yanu Yapakhomo Yapa Wi-Fi IP ndi Msakatuli Wodziwika / Foni"]
    K --> L["Imbani Nthawi yomweyo Mabanki Anu, Onyamula Mafoni & Kusinthanitsa kwa Crypto ndi Foni Kuti Muyimitse Akaunti Yomangidwa ndi Imelo Imeneyo"]

Gawo 1: Kuwunika kozama kokhazikika ndi opereka maimelo (Gmail, Outlook/M365, Yahoo, iCloud)¶

Wopereka maimelo wamkulu aliyense amasunga malamulo otumizira, zosefera, ma tokeni a OAuth, ndi nthumwi zamabokosi amakalata mumamenyu osiyanasiyana. Ngakhale mutagwiritsa ntchito Apple Mail kapena Outlook Desktop pakompyuta yanu, muyenera kulowa muakaunti yapaintaneti yovomerezeka ya woperekayo mu msakatuli wapakompyuta (kapena pemphani "Desktop Site" pa msakatuli wanu wam'manja) kuti muwone zosintha zapambali za seva.

Kuyenda Kwambiri 1: Kutsuka Akaunti Yowonongeka ya Google / Gmail¶

Mukayeretsa akaunti yomwe yawonongeka ya Gmail kapena Google Workspace, fufuzani ma tabu asanu ndi awiriwa osadumpha ngakhale imodzi:

1. Audit Security & Passkeys (myaccount.google.com/security):
   • Dinani Makiyi achinsinsi ndi makiyi achitetezo: Zigawenga zimalembetsa nthawi yomweyo kiyi yolumikizira kapena yotsimikizira pa msakatuli wawo kuti athe kulowanso ndi mawu achinsinsi a zero ndi zero SMS mwachangu. Chotsani chinsinsi chilichonse chomwe simukuchidziwa ndi chitsimikizo cha 100%.
   • Dinani Kutsimikizira Masitepe Awiri -> fufuzani Chitsimikizo, Zida za Google Prompt, Foni yobwezeretsa, ndi Makhodi osunga zosunga zobwezeretsera. Dinani Pangani ma code atsopano kuti muchotse manambala 8 omwe owukirayo adajambula.
2. ** Kuwononga Mawu Achinsinsi Ogwiritsa Ntchito (myaccount.google.com/apppasswords)**:
   • Mawu Achinsinsi a App ndi chiphaso cha zilembo 16 chomwe chimalola kasitomala wamakalata a IMAP (monga Thunderbird kapena cholembera cha hacker's Python) kutsitsa bokosi lanu lonse mpaka kalekale pamene akulambalala Kutsimikizira Masitepe Awiri. Chotsani Mawu Achinsinsi onse a App omwe atchulidwa.
3. Chotsani Malumikizidwe a OAuth a Gulu Lachitatu (myaccount.google.com/connections):
   • Yang'anani pulogalamu iliyonse yololedwa kulowa mu Gmail, Google Drive, kapena Google Contacts (zigawenga nthawi zambiri zimagwiritsa ntchito makasitomala owoneka ngati ovomerezeka ngati eM Client, Newton Mail, Cleanfox, kapena zolemba za OAuth). Dinani pulogalamuyi -> Chotsani maulumikizidwe onse omwe muli nawo ndi [Dzina la App].
4. Chongani Gmail Accounts and Import Tabu (Kutumiza Makalata & Reply-To Kubedwa):
   • Mu Gmail pakompyuta yapakompyuta, dinani chizindikiro cha zida -> Onani zokonda zonse -> Maakaunti ndi Kulowetsa.
   • Pansi pa Perekani mwayi wolowa muakaunti yanu, tsimikizirani kuti ZERO ma adilesi a imelo alembedwa. Wogwiritsa ntchito amatha kuwerenga, kutumiza, ndikuchotsa maimelo anu popanda kudziwa mawu anu achinsinsi.
   • Pansi pa **Tumizani imelo monga **, dinani edit info pafupi ndi dzina lanu ndikutsimikizira kuti woukirayo sanaike chinsinsi Specify a different "reply-to" address (mwachitsanzo, kukhazikitsa Reply-To to yourname.company@gmail.com kapena domeni yowoneka ngati yowukira kotero kuti wina akayankha maimelo anu ovomerezeka, yankho lawo limapita kwa wowononga m'malo mwa inu).
5. Chongani Gmail Filters and Blocked Addresses Tabu:
   • Yang'anani mwatcheru pa fyuluta iliyonse. Owukira nthawi zambiri amapanga zosefera zofanana from:(a|e|i|o|u) kapena size > 0 kapena has:attachment kapena mawu osakira ngati invoice, wire, bank, security, alert, code ndi zochita Skip the Inbox (Archive it), Mark as read, Delete it, kapena Forward it to:. Chotsani zosefera zilizonse zosadziwika.
6. Chongani Gmail Forwarding and POP/IMAP Tabu:
   • Tsimikizirani kuti **Kutumiza ** kwakhazikitsidwa ku **Letsani kutumiza **, chotsani adilesi yotumizira yosadziwika pamndandanda wotsikirapo, ndikukhazikitsa kufikira kwa IMAP kuti Zimitsani IMAP (pokhapokha mutagwiritsa ntchito kasitomala wotetezedwa pakompyuta).
7. Onani zinyalala za Google Drive & Mbiri ya Google Takeout:
   • Zigawenga nthawi zambiri zimayambitsa Google Takeout (takeout.google.com) sungani kuti mutsitse a .zip maimelo anu onse, Google Photos, ndi zikalata za Google Drive, kuphatikiza zobweza msonkho ndi mindandanda yachinsinsi. Pitani takeout.google.com pakali pano: ngati muwona zotumiza kapena zomaliza zomwe simunapemphe, dinani **Kuletsa kutumiza ** ndikuwona ndendende magulu a data omwe adapakidwa.

Kuyenda Kwambiri 2: Kutsuka Akaunti Yowonongeka ya Microsoft Outlook.com / Hotmail / Microsoft 365¶

Akaunti ya Microsoft (@outlook.com, @hotmail.com, @live.com, @msn.com, ndi mabokosi a makalata a Microsoft 365 Exchange Online) ali ndi malo angapo obisala omwe owukira amagwiritsa ntchito pa Business Email Compromise (BEC) ndi ma hacks ogula:

1. Zobisika RSS Feeds ndi Conversation History Folder Trap:
   • Mu Outlook, owukira samakonda kutsitsa maimelo ku main Deleted Items foda chifukwa ogwiritsa amafufuza Deleted Items. M'malo mwake, amapanga Outlook Rule yotchedwa . kapena 1 zomwe zimasuntha maimelo obwera ku RSS Feeds, Archive, kapena Conversation History foda ndikuyika chizindikiro kuti ikuwerengedwa. Yang'anani chikwatu chilichonse chakumanzere chakumanzere, makamaka RSS Feeds, pakali pano.
2. Audit Onse Rules NDI Sweep mu Outlook Web (outlook.live.com kapena outlook.office.com):
   • Dinani Zikhazikiko Zida (pamwamba kumanja) -> Maimelo -> Malamulo. Chotsani lamulo lililonse lomwe simunapange.
   • Onani bokosi lomwe lili pansi pa lamulo la woukira: Stop processing more rules. Zigawenga fufuzani bokosi ili pa malamulo awo apamwamba kuti pasakhale malamulo anu ovomerezeka.
   • Kenako, dinani Maimelo -> Sesani ndi Maimelo -> Imelo yopanda pake -> Otumiza ndi madambwe oletsedwa. Owukira amawonjezera nthawi zonse @microsoft.com, @google.com, @apple.com, @chase.com, @bankofamerica.com,ndi @coinbase.com pamndandanda wanu Oletsedwa Otumiza ndi Ma Domain kuti zidziwitso zachitetezo zidutse kapena pitani mwakachetechete ku Junk. Chotsani mndandanda wa Otumiza Oletsedwa amakampani aliwonse ovomerezeka.
3. ** Onani Mail -> Forwarding and IMAP**:
   • Onetsetsani kuti Yambitsani kutumizirana zinthu sichoncho. Ngati imelo adilesi ya wowukirayo akukhala m'bokosi ndi "Keep a copy of forwarded messages" osasankhidwa, imelo iliyonse yotumizidwa kwa inu imatumizidwa kwa wowononga ndikuchotsedwa m'bokosi lanu la makalata musanagunde Makalata Obwera.
4. Kwa Oyang'anira Makampani a Microsoft 365: Thamangani PowerShell Kuti Muvumbulutse Ma API Obisika / Malamulo Olakwika a Mabokosi Obwera (MFCMAPI):
   • Osewera owopsa a BEC amagwiritsa ntchito API ya Exchange Web Services (EWS) kapena MFCMAPI kupanga malamulo obisika obisika a Ma Inbox (pochotsa PR_RULE_MSG_NAME ndi PR_RULE_MSG_PROVIDER Katundu wa MAPI) zomwe ** sizimawonekera konse mu Outlook Web GUI kapena Standard Exchange Admin Center **.
   • Woyang'anira IT akuyenera kulumikizana ndi Exchange Online PowerShell ndikuyendetsa:

     Get-InboxRule -Mailbox victim@yourdomain.com -IncludeHidden | Format-List Name,Enabled,Description,ForwardTo,ForwardAsAttachmentTo,RedirectTo,DeleteMessage,MoveToFolder
     

   • Kuwonjezera -IncludeHidden mbendera imawulula malamulo obisika a MAPI obisika mu bokosi la makalata la Associated Contents table (FAI), yomwe imatha kutsukidwa kudzera Remove-InboxRule -Mailbox victim@yourdomain.com -Identity "<RuleID>" kapena poyambitsa outlook.exe /cleanrules.
   • Yang'aniraninso Malamulo Osinthana Obwereketsa (Malamulo Oyenda Maimelo) kudzera Get-TransportRule: ngati wowukirayo adasokoneza akaunti ya Exchange Administrator, atha kukhala kuti adapanga lamulo lapadziko lonse lapansi loti azitumizira makalata m'malo motsatira bokosi la makalata.

Gawo 2: Zoyenera kuchita ngati mwatsekedwa kwathunthu (Attacker adasintha mawu achinsinsi & 2FA)¶

Ngati wowukirayo asintha kale mawu achinsinsi, m'malo mwa nambala yanu yafoni yochira ndi yake, ndi kuyatsa pulogalamu yawoyawo ya Authenticator kapena kiyi ya Hardware, mphindi iliyonse imawerengedwa chifukwa wowukirayo akubera maakaunti anu olumikizidwa pomwe mudatsekeredwa.

Khwerero 1: Dulani Kugwiritsa Ntchito Ndalama Kwa Wowononga Poyamba (Mphindi 15 Zoyamba)¶

Osataya maola atatu mukulimbana ndi fomu yobweza imelo yodzichitira yokha pomwe wobera akuchotsa akaunti yanu yakubanki pogwiritsa ntchito bokosi lanu lolandidwa:

1. Call Your Banks, Credit Card Issuers, and Investment Brokerages by Telephone:
   • Tell the Fraud Department: "My primary email address [your@email.com] has been compromised and I am currently locked out of it. Place an immediate verbal password / security freeze on my profile, revoke active web/mobile sessions, and remove that email address from self-service password resets."
2. Lock Your Mobile Phone Carrier Account Against a Follow-On SIM Swap:
   • Inside your hacked inbox, the attacker can read your monthly AT&T, Verizon, T-Mobile, Rogers, Vodafone, or O2 bills, giving them your mobile account number and billing address. Call your carrier immediately to verify your Number Transfer PIN / Port Freeze and Account Passcode are locked down.
3. Freeze Your Cryptocurrency Exchange Accounts (Coinbase, Binance, Kraken, Gemini):
   • Most major exchanges provide a one-click or emergency phone Account Lock if your email is compromised (for example, calling Coinbase automated emergency lock at +1 (888) 908-7930 in the US/International or +44 808 168 4635 in the UK).
4. Change the Registered Email Address on Every Account You Can Still Log Into:
   • You are likely still logged in to Amazon, PayPal, Venmo, Steam, Discord, Apple ID, and your password manager on your smartphone app right now. Create a brand-new, clean emergency email account (for example, on ProtonMail or a fresh Gmail secured with a hardware key) and immediately go into the app settings of your still-logged-in apps to switch their contact email away from the hacked address before the attacker resets them.

Step 2: How to Pass the Automated Account Recovery Algorithms (Google, Microsoft, Yahoo)¶

For free consumer email accounts (@gmail.com, @outlook.com, @hotmail.com, @yahoo.com), human support agents are strictly prohibited by engineering controls from manually resetting passwords or bypassing 2FA over the phone (to prevent social engineering). Instead, recovery is governed by an automated Risk & Identity Scoring Engine. To maximize your cryptographic trust score and trigger the hidden "7-Day / 30-Day Security Hold Override":

1. CRITICAL RULE: Submit the Recovery Form from Your Exact Historical Device, Browser, and Home Wi-Fi IP Address:
   • Never run accounts.google.com/signin/recovery kapena account.live.com/acsr from a brand-new incognito browser window on cellular data or through a VPN.
   • Gwiritsani ntchito laputopu yeniyeni, kompyuta, kapena foni yamakono ndi msakatuli weniweni (wokhala ndi makeke/zosungirako) momwe mudalowa muakaunti ya imelo imeneyo tsiku lililonse kwa chaka chathachi, pomwe mukulumikizidwa ku nyumba yanu kapena ofesi Wi-Fi rauta (ASN ndi machesi a geolocation). The recovery algorithm yolemetsa kwambiri zizindikiro zala zala (DeviceID) ndi mbiri ya IP subnets.
2. Google / Gmail Recovery (accounts.google.com/signin/recovery):
   • Ngakhale wachiwembuyo atasintha foni yanu yobwezeretsanso ndi imelo yobwezeretsa masekondi apitawo, **Google imasunga nambala yanu ya foni YAM'MBUYO YOTSATIRA TUMIZANI LINKI SINDIKIZANI KOPERANI MAPODIKASITI MITU YA NKHANI YAM'MBUYO YOTSATIRA TUMIZANI LINKI SINDIKIZANI KOPERANI MAPODIKASITI MITU YA NKHANI YAM'MBUYO YOTSATIRA TUMIZANI LINKI SINDIKIZANI KOPERANI MAPODIKASITI MITU YA NKHANI YAM'MBUYO YOTSATIRA TUMIZANI LINKI SINDIKIZANI KOPERANI MAPODIKASITI MITU YA NKHANI YAM'MBUYO YOTSATIRA TUMIZANI LINKI SINDIKIZANI KOPERANI MAPODIKAS here?
   • Pamene anauzidwa panthawi signin/recovery, dinani "Yesani njira ina" mpaka itadzipereka kutumiza khodi ku nambala yoyambirira ya foni kapena yoyamba adilesi yobwezeretsa*, kapena ikadzakutumizirani foni/iPhone yanu ya Android yolembetsedwa kale kudzera ku Google Prompt.
   • If You Subscribe to Google One (Paid Cloud Storage) or YouTube Premium / YouTube Channel:
     • Olembetsa a Google One omwe amalipidwa ali ndi mwayi wopeza chithandizo chamunthu Google One Support (one.google.com/support) omwe angachulukitse ma akaunti okhoma mkati.
     • If your hacked Google account owns a YouTube Channel, contact @TeamYouTube pa X (poyamba Twitter) poyera nthawi yomweyo. Mosiyana ndi Gmail yokhazikika, @TeamYouTube Creator Support provides a dedicated Hacked Account Escalation Form piloted by human Google trust-and-safety engineers who verify your original Channel ID (UC..), AdSense ID, and upload IP history to physically strip the attacker's passkeys/MFA and restore your entire Google/Gmail account within 24 to 72 hours.
3. Microsoft Outlook / Hotmail / Xbox Account Recovery (account.live.com/acsr):
   • First, try logging in and clicking "I don't have any of these" at the 2FA screen: if you have a 25-character Microsoft Recovery Code saved when you originally set up your account, entering it lets you replace the attacker's security info (subject to Microsoft's mandatory 30-day security info replacement waiting period, during which the attacker can also be blocked if you flag the account).
   • When filling out the Microsoft Account Recovery Form (account.live.com/acsr) from your home Wi-Fi IP:
     • Provide the exact Subject lines of 3 to 4 recent emails you sent (ask friends or family to look in their own inbox and read you the exact character-for-character Subject lines of emails you sent them recently).
     • Provide the exact email addresses of contacts you recently emailed.
     • Provide your Xbox Console Hardware LiveDeviceID / Serial Number if you ever signed into an Xbox with that Microsoft account, and the last 4 digits and expiration date of any credit card ever used on Microsoft Store / Skype / Office 365.

Phase 3: Damage control for secrets exposed inside your old emails¶

Once you have locked the attacker out and cleaned all rules and OAuth tokens, you must confront a sobering forensic reality: if the attacker had IMAP, OAuth, or web access to your mailbox for even 15 minutes, assume they ran an automated keyword search across your entire historical email archive.

Attackers do not read your 50,000 old emails manually. Their automated scripts immediately search your inbox for these exact ten high-value keywords and download every matching message and PDF attachment:

1. "seed", "mnemonic", "recovery phrase", "24 words", "wallet", "Coinbase", "Binance", "Ledger": If you ever emailed yourself a photo, text note, or encrypted zip of a cryptocurrency seed phrase or 2FA backup code, consider that wallet compromised immediately and move all funds to a brand-new hardware wallet.
2. "tax", "1040", "W-2", "1099", "SSN", "Social Security", "passport", "driver license", "mortgage", "closing": Loan applications, apartment leases, and CPA emails inside your inbox almost certainly contain PDFs with your unredacted Social Security Number (or national ID), date of birth, and driver's license photo. Place an immediate Credit Freeze with Equifax, Experian, and TransUnion (see our guide on identity theft response).
3. "password", "login", "credentials", "welcome to", "backup codes": Search your own inbox right now for the words password ndi backup code, delete those dangerous plaintext emails after rotating every single password mentioned in them.
4. "invoice", "ACH", "wire", "routing", "escrow", "closing costs", "docusign": If you are in the middle of buying a house, paying a contractor, or running a business, the attacker now has copies of your real invoices and banking routing details and will attempt to impersonate you or your title company to steal the wire transfer. Call your real estate title company, escrow officer, or clients on the telephone immediately to warn them.

Mafunso omwe amafunsidwa pafupipafupi¶

Magwero afufuzidwa¶

• Cybersecurity and Infrastructure Security Agency (CISA, United States): Protecting Against Business Email Compromise (BEC), OAuth Application Abuse, and Phishing-Resistant MFA Guidance (cisa.gov/MFA ndi cisa.gov).
• Microsoft Security Response Center & Defender Threat Intelligence (United States): Responding to a Compromised Email Account in Microsoft Defender for Office 365 (Hidden Inbox Rules -IncludeHidden, OAuth Consent Grants, and Session Revocation) (learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account).
• Google Account Security & Workspace Admin Help (United States): Secure a Hacked or Compromised Google Account, OAuth Third-Party Connections, and Advanced Protection Program (support.google.com/accounts/answer/6294825).
• National Cyber Security Centre (NCSC, United Kingdom): Recovering a Compromised Email Account and Mitigating Email Forwarding Rule Persistence (ncsc.gov.uk).
• Federal Trade Commission (FTC, United States): What To Do if Your Email Account Is Hacked (consumer.ftc.gov).
• Australian Cyber Security Centre (ACSC / ASD, Australia): Protecting Email Accounts and Detecting Unauthorized Inbox Rules (cyber.gov.au).

Maupangiri ogwirizana¶

• Phishing ndi akaunti zosokoneza
• MFA phishing and adversary-in-the-middle bypass
• Kutsekera kwa MFA ndi kubwezeretsa kwachitsimikiziro
• Kuyankha kuphwanya kwa data komanso kutulutsa mawu achinsinsi
• Malware, ransomware, and spyware infection
• SIM swapping