Hacked email account: hidden forwarding rules and recovery¶

Your primary email account is the skeleton key to your entire digital, financial, and legal identity. Unlike a compromised social media profile or streaming login, a hacked Gmail, Microsoft Outlook / Microsoft 365, Yahoo, Apple iCloud Mail, or ProtonMail account gives an attacker the power to click "Forgot Password" on your bank accounts, cryptocurrency exchanges, retirement brokerages, tax portals, and cloud drives. Most dangerously, merely changing your email password and turning on Two-Factor Authentication (2FA) rarely kicks a sophisticated attacker out of a hacked inbox. Within 30 seconds of breaking into an email account, modern attackers plant five layers of silent persistence backdoors: hidden Inbox Sweep and Forwarding Rules (often named ., .., ё [Blank] that silently move password-reset emails straight to the Trash ё RSS Feeds folder so you never see them), Third-Party OAuth Application Grants (eM Client, Thunderbird, or fake Google Docs apps that retain full API read/write access without needing your password), Delegated Mailbox Permissions, App Passwords (IMAP/SMTP), and Recovery Email / Phone Number swaps.

If an email compromise involves immediate threats of physical violence, stalking, domestic abuse, or extortion against a minor, call your local emergency number (911 дар Иёлоти Муттаҳида ва Канада, 112 дар саросари Иттиҳоди Аврупо, 999 дар Британияи Кабир) ё ба феҳристи байналмилалии мо муроҷиат кунед рақамҳои фавқулодда right away. For all consumer and corporate inbox takeovers, execute the 6-step eradication sequence below in exact order.

Ҳоло ин корро кунед¶

1. Do NOT change your password from the same Windows PC or Mac if you suspect an Infostealer virus: If your email was hacked even though you already had Two-Factor Authentication (2FA) turned on, your computer likely has an Infostealer malware infection (such as Lumma Stealer, RedLine, or Atomic macOS Stealer) or a malicious Chrome/Edge extension that steals live authenticated browser session cookies (SAPISID/SID on Google or ESTSAUTH on Microsoft). Pick up a clean smartphone (iOS or Android) to perform your password change and security cleanup right now.
2. Audit and revert your Account Recovery Email, Recovery Phone Number, and MFA Authenticator devices BEFORE changing your password (or within 30 seconds after): Attackers immediately add their own burner phone number, disposable email address, or rogue Authenticator app to your security settings. If you change your password without deleting the attacker's recovery phone or rogue passkey, the attacker will simply click "Forgot Password" 10 seconds later and lock you out permanently.
3. Force-terminate all active login sessions, persistent browser cookies, and App Passwords globally: Changing a password does not always immediately kill existing mobile IMAP tokens or active web session cookies. Explicitly click "Sign out of all devices / Revoke all sessions" in your Google, Microsoft, Yahoo, or Apple security dashboard, and delete every 16-character App Password on the account.
4. Open a desktop web browser (not a mobile mail app) and delete all hidden Inbox Rules, Filters, Auto-Forwarders, and Sweep Rules: Mobile mail apps (Gmail ё Outlook дар iOS/Android) аксар вақт қоидаҳои пешрафтаи масирро дар сервер пинҳон мекунанд. Танзимоти веб-почтаи электронии худро дар браузери мизи корӣ кушоед ва Филтрҳо ва суроғаҳои масдудшуда, Интиқол ва POP/IMAP ва Қоидаҳо/Тозакунӣ-ро тафтиш кунед. Ҳама гуна қоидаеро, ки паёмҳои беруниро ирсол мекунад ё ба таври худкор паёмҳои дорои калимаҳои монанди инҳоро интиқол медиҳад, нест кунед "bank", "code", "reset", "security", "wire", "invoice", ё "crypto" ба Trash, Archive, ё RSS Feeds folder.
5. Тамоми барномаҳои тарафи сеюм ва вакилони паёмдони OAuth-ро бекор кунед: Ба Барномаҳо ва хидматҳои тарафи сеюм (Google) ё Барномаҳо ва хидматҳое, ки ба шумо дастрасӣ додаед (Microsoft/Yahoo) гузаред ва ҳар як барномаро бо Mail.Read, Mail.ReadWrite, ё Gmail API permissions, plus check Grant Access to Your Account (Delegation) so the attacker cannot read your inbox through an OAuth token that completely ignores password changes.
6. ** Худро санҷед Trash (Bin), Sent, ва Spam folders immediately to see which financial or crypto accounts the attacker already reset**: Attackers delete incoming security alerts from your bank, Coinbase/Binance, Amazon, PayPal, or Steam seconds after receiving the 6-digit verification code. Open your Trash ва Sent folders right now: every password-reset email sitting in your Trash is an account the attacker has already breached or attempted to breach.

Decision tree: regaining control and purging persistence backdoors¶

Follow this step-by-step triage tree whether you still have access to your inbox or have been completely locked out by the attacker:

flowchart TD
    A["Suspected or Confirmed Email Account Compromise"] --> B{"Can you still log into your email account right now?"}
    B -->|"Yes: I still have access"| C["Switch to a Clean Smartphone (Avoid Potentially Infected PC)"]
    C --> D["1. Remove Attacker's Recovery Phone, Recovery Email & Rogue MFA Passkeys"]
    D --> E["2. Change Password to Unique 20+ Char Passphrase & Enable Phishing-Resistant 2FA"]
    E --> F["3. Click 'Sign Out of All Devices' & Delete All 16-Char App Passwords"]
    F --> G["4. Open Desktop Webmail: Purge Hidden Forwarding, Filters, Sweep Rules & Delegates"]
    G --> H["5. Revoke OAuth Third-Party Apps & Inspect Trash/Sent Folders for Breached External Accounts"]
    B -->|"No: Attacker changed password and recovery phone/MFA"| I{"What type of email account is locked?"}
    I -->|"Work / School / Corporate Domain (@company.com)"| J["Contact IT Admin Immediately: Admin Can Reset MFA, Revoke Tokens & Restore Access in 60 Seconds via Admin Console"]
    I -->|"Personal Gmail / Outlook.com / Yahoo / iCloud"| K["Шакли худкори барқарорсозии ҳисобро аз IP таърихии хонаи Wi-Fi ва браузер/телефони шинос иҷро кунед"]
    K --> L["Дарҳол ба бонкҳо, операторони мобилӣ ва биржаҳои криптовалютӣ тавассути телефон занг занед, то ҳисобҳои ба ин почтаи электронӣ алоқамандро ях кунед"]

Марҳилаи 1: Аудити устувории амиқ аз ҷониби провайдери почтаи электронӣ (Gmail, Outlook/M365, Yahoo, iCloud)¶

Ҳар як провайдери асосии почтаи электронӣ қоидаҳои интиқол, филтрҳо, аломатҳои OAuth ва вакилони паёмдони почтаро дар менюҳои каме гуногун нигоҳ медорад. Ҳатто агар шумо Apple Mail ё Outlook Desktop-ро дар компютери худ истифода баред, шумо бояд ба интерфейси веб-почтаи расмии провайдер дар браузери мизи корӣ ворид шавед (ё дархост кардани "Сайти мизи корӣ" дар браузери мобилии худ) барои дидани ин танзимоти сервер.

Detailed Walkthrough 1: Purging a Hacked Google / Gmail Account¶

When cleaning a compromised Gmail or Google Workspace account, work through these exact seven tabs without skipping a single one:

1. Audit Security & Passkeys (myaccount.google.com/security):
   • Click Passkeys and security keys: Attackers immediately register a synced passkey or virtual authenticator on their own browser so they can log back in with zero password and zero SMS prompt. Delete any passkey you do not recognize with 100 percent certainty.
   • Тафтишоти 2-қадам -> санҷед Authenticator, Таҷҳизоти Google Prompt, Телефони барқарорсозӣ ва Рамзҳои эҳтиётӣ-ро клик кунед. Барои фавран беэътибор кардани ҳама гуна рамзҳои эҳтиётии 8-рақама, ки ҳамлагар скриншот гирифта буд, Эҷод кардани кодҳои нав-ро клик кунед.
2. ** Рамзҳои фаъоли барномаро нест кунед (myaccount.google.com/apppasswords)**:
   • Рамзи Пароли барнома гузарвожаи 16 ҳарфӣ мебошад, ки ба муштарии почтаи IMAP (ба монанди Thunderbird ё скрипти Python-и хакер) имкон медиҳад, ки тамоми паёмдони шуморо абадан зеркашӣ кунад дар ҳоле ки пурра аз санҷиши 2-қадам гузашт. Ҳар як пароли барномаро дар рӯйхат нест кунед.
3. ** Бекор кардани пайвастҳои OAuth-и тарафи сеюм (myaccount.google.com/connections)**:
   • Ҳар як барномаеро, ки ба Gmail, Google Drive ё Google Contacts дастрасӣ дорад, ҷустуҷӯ кунед (ҳамлагарон аксар вақт муштариёни почтаи қонунии ба назар намоёнро истифода мебаранд, ба монанди eM Client, Newton Mail, Cleanfox, ё скриптҳои фармоишии OAuth). Барномаро клик кунед -> Ҳамаи пайвастҳои бо [Номи барнома] доштаатонро нест кунед.
4. ** Gmail-ро санҷед Accounts and Import Tab (Mail Delegation & Reply-To Hijacking)**:
   • In Gmail on a desktop computer, click the Gear icon -> See all settings -> Accounts and Import.
   • Under Grant access to your account, verify that ZERO email addresses are listed. A delegated user can read, send, and delete your emails without knowing your password.
   • Under Send mail as, click edit info next to your own name and verify the attacker did not insert a secret Specify a different "reply-to" address (for example, setting your Reply-To to yourname.company@gmail.com or an attacker lookalike domain so that whenever someone replies to your legitimate emails, their reply goes to the hacker instead of you).
5. ** Gmail-ро санҷед Filters and Blocked Addresses Tab**:
   • Look closely at every filter. Attackers often create filters matching from:(a|e|i|o|u) ё size > 0 ё has:attachment or keywords like invoice, wire, bank, security, alert, code with the action Skip the Inbox (Archive it), Mark as read, Delete it, or Forward it to:. Delete every unfamiliar filter.
6. ** Gmail-ро санҷед Forwarding and POP/IMAP Tab**:
   • Verify Forwarding is set to Disable forwarding, remove any unrecognized forwarding address from the dropdown list, and set IMAP access to Disable IMAP (unless you specifically use a secure desktop client).
7. Check Google Drive Trash & Google Takeout History:
   • Attackers frequently trigger a Google Takeout (takeout.google.com) archive to download a .zip of all your emails, Google Photos, and Google Drive documents, including tax returns and password lists. Visit takeout.google.com right now: if you see an active or completed export you did not request, click Cancel export and see exactly which data categories were packaged.

Detailed Walkthrough 2: Purging a Hacked Microsoft Outlook.com / Hotmail / Microsoft 365 Account¶

Microsoft accounts (@outlook.com, @hotmail.com, @live.com, @msn.com, and corporate Microsoft 365 Exchange Online mailboxes) have several unique hiding spots that attackers exploit during Business Email Compromise (BEC) and consumer hacks:

1. The Hidden RSS Feeds ва Conversation History Folder Trap:
   • In Outlook, attackers rarely route suppressed emails into the main Deleted Items folder because users check Deleted Items. Instead, they create an Outlook Rule named . ё 1 that moves incoming emails into the RSS Feeds, Archive, or Conversation History folder and marks them as read. Check every folder in your left sidebar, especially RSS Feeds, right now.
2. Audit Both Rules AND Sweep in Outlook Web (outlook.live.com ё outlook.office.com):
   • Click the Settings Gear (top right) -> Mail -> Rules. Delete any rule you did not create.
   • Notice the checkbox at the bottom of an attacker's rule: Stop processing more rules. Attackers check this box on their top rule so none of your legitimate rules run.
   • Next, click Mail -> Sweep and Mail -> Junk email -> Blocked senders and domains. Attackers routinely add @microsoft.com, @google.com, @apple.com, @chase.com, @bankofamerica.com, ва @coinbase.com to your Blocked Senders and Domains list so security alerts bounce or go silently to Junk. Clear your Blocked Senders list of any legitimate companies.
3. Check Mail -> Forwarding and IMAP:
   • Ensure Enable forwarding is unchecked. If an attacker's email address is sitting in the box with "Keep a copy of forwarded messages" unchecked, every email sent to you was being forwarded to the hacker and deleted from your mailbox before it ever hit your Inbox.
4. For Corporate Microsoft 365 Administrators: Run PowerShell to Uncover Hidden MAPI / Corrupt Inbox Rules (MFCMAPI):
   • Sophisticated BEC threat actors use the Exchange Web Services (EWS) API or MFCMAPI to create hidden corrupted Inbox rules (by stripping the PR_RULE_MSG_NAME ва PR_RULE_MSG_PROVIDER MAPI properties) that do not show up at all in the Outlook Web GUI or standard Exchange Admin Center.
   • An IT Administrator should connect to Exchange Online PowerShell and run:

     Get-InboxRule -Mailbox victim@yourdomain.com -IncludeHidden | Format-List Name,Enabled,Description,ForwardTo,ForwardAsAttachmentTo,RedirectTo,DeleteMessage,MoveToFolder
     

   • Adding the -IncludeHidden flag exposes stealth MAPI rules hiding in the mailbox's Associated Contents table (FAI), which can then be purged via Remove-InboxRule -Mailbox victim@yourdomain.com -Identity "<RuleID>" or by launching outlook.exe /cleanrules.
   • Also inspect Tenant-Level Exchange Transport Rules (Mail Flow Rules) via Get-TransportRule: if the attacker compromised an Exchange Administrator account, they may have created a global organization-wide mail flow rule rather than an individual mailbox rule.

Phase 2: What to do if you are completely locked out (Attacker changed password & 2FA)¶

If the attacker already changed your password, replaced your recovery phone number with their own, and turned on their own Authenticator app or hardware key, every minute counts because the attacker is actively looting your linked accounts while you are locked out.

Step 1: Cut Off the Attacker's Financial Leverage First (First 15 Minutes)¶

Do not spend three hours fighting an automated email recovery form while the hacker drains your bank account using your hijacked inbox:

1. Call Your Banks, Credit Card Issuers, and Investment Brokerages by Telephone:
   • Tell the Fraud Department: "My primary email address [your@email.com] has been compromised and I am currently locked out of it. Place an immediate verbal password / security freeze on my profile, revoke active web/mobile sessions, and remove that email address from self-service password resets."
2. Lock Your Mobile Phone Carrier Account Against a Follow-On SIM Swap:
   • Inside your hacked inbox, the attacker can read your monthly AT&T, Verizon, T-Mobile, Rogers, Vodafone, or O2 bills, giving them your mobile account number and billing address. Call your carrier immediately to verify your Number Transfer PIN / Port Freeze and Account Passcode are locked down.
3. Freeze Your Cryptocurrency Exchange Accounts (Coinbase, Binance, Kraken, Gemini):
   • Most major exchanges provide a one-click or emergency phone Account Lock if your email is compromised (for example, calling Coinbase automated emergency lock at +1 (888) 908-7930 in the US/International or +44 808 168 4635 in the UK).
4. Change the Registered Email Address on Every Account You Can Still Log Into:
   • You are likely still logged in to Amazon, PayPal, Venmo, Steam, Discord, Apple ID, and your password manager on your smartphone app right now. Create a brand-new, clean emergency email account (for example, on ProtonMail or a fresh Gmail secured with a hardware key) and immediately go into the app settings of your still-logged-in apps to switch their contact email away from the hacked address before the attacker resets them.

Step 2: How to Pass the Automated Account Recovery Algorithms (Google, Microsoft, Yahoo)¶

For free consumer email accounts (@gmail.com, @outlook.com, @hotmail.com, @yahoo.com), human support agents are strictly prohibited by engineering controls from manually resetting passwords or bypassing 2FA over the phone (to prevent social engineering). Instead, recovery is governed by an automated Risk & Identity Scoring Engine. To maximize your cryptographic trust score and trigger the hidden "7-Day / 30-Day Security Hold Override":

1. CRITICAL RULE: Submit the Recovery Form from Your Exact Historical Device, Browser, and Home Wi-Fi IP Address:
   • Never run accounts.google.com/signin/recovery ё account.live.com/acsr from a brand-new incognito browser window on cellular data or through a VPN.
   • Аз ноутбук, мизи корӣ ё смартфон ва браузери дақиқ (бо кукиҳои солим/захираи маҳаллӣ) истифода баред, ки дар он шумо дар давоми як соли охир ҳар рӯз ба ин ҳисоби почтаи электронӣ ворид шудаед, дар ҳоле ки ба **роутери муқаррарии хона ё идораи Wi-Fi ** пайваст шудаед (ASN ва мувофиқати географӣ). Алгоритми барқарорсозӣ аломатҳои изи ангуштони дастгоҳро вазнин мекунад (DeviceID) ва зершабакаҳои таърихии IP.
2. Барқарорсозии Google / Gmail (accounts.google.com/signin/recovery):
   • Ҳатто агар ҳамлагар телефони барқарорсозӣ ва почтаи электронии барқарорсозии шуморо сонияҳо пеш иваз кунад ҳам, Google рақами телефони ПЕШКИНИ барқарорсозӣ ва суроғаи почтаи электронии ПЕШНИ барқароркунандаи шуморо ҳамчун омилҳои барқарорсозӣ маҳз дар тӯли 7 рӯзи тақвимӣ (168 соат) пас аз тағир додани ҳамлагар нигоҳ медорад.
   • Вақте ки дар давоми signin/recovery, **"Роҳи дигарро санҷед"-ро клик кунед, то он даме ки он барои фиристодани код ба рақами телефони аслӣ ё суроғаи почтаи электронии барқарорсозии *аслӣ пешниҳод кунад, ё тавассути Google Prompt телефони/iPhone-и қаблан ба қайд гирифтаи шуморо дархост кунад.
   • Агар шумо ба Google One (Нигоҳдории абрии пулакӣ) ё YouTube Premium / канали YouTube обуна шавед:
     • Муштариёни пулакии Google One дастрасии зиндаи инсонӣ доранд Дастгирии Google One (one.google.com/support) ки метавонад ҳисобҳои басташударо дар дохили худ афзоиш диҳад.
     • Агар ҳисоби Google-и ҳакершудаи шумо соҳиби канали YouTube бошад, бо ** тамос гиред@TeamYouTube дар X (собиқ Twitter) ** фавран ба таври оммавӣ. Баръакси Gmail стандартӣ, @TeamYouTube Дастгирии эҷодкорон як шакли махсуси Шакли афзоиши ҳисобҳои ҳакершуда-ро пешниҳод мекунад, ки аз ҷониби муҳандисони боваринок ва бехатарии Google таҳия шудааст, ки асли шуморо тасдиқ мекунанд. Channel ID (UC..), AdSense ID-ро ворид кунед ва таърихи IP-ро бор кунед, то калидҳои гузарвожаи ҳамлакунанда/ВМХ-ро ба таври ҷисмонӣ канда кунед ва тамоми ҳисоби Google/Gmail-и худро дар давоми 24 то 72 соат барқарор кунед.
3. Барқарорсозии ҳисоби Microsoft Outlook / Hotmail / Xbox (account.live.com/acsr):
   • Аввалан, кӯшиш кунед, ки ворид шавед ва клик кунед "Ман ҳеҷ яке аз инҳоро надорам" дар экрани 2FA: агар шумо 25 аломати Рамзи барқарорсозии Microsoft дошта бошед, ки ҳангоми таъсиси ҳисоби худ захира кардаед, ворид кардани он ба шумо имкон медиҳад, ки маълумоти амниятии ҳамлагарро иваз кунед (бо назардошти ҳатмӣ аз Microsoft **маълумоти амниятии **30-рӯза, агар шумо инчунин метавонед дар давоми давраи ҳамлаи 30-рӯзаи амниятӣ иваз кунед, агар шумо онро иваз кунед. ҳисоб).
   • When filling out the Microsoft Account Recovery Form (account.live.com/acsr) аз Wi-Fi IP хонаатон:
     • сатрҳои дақиқи Мавзӯъро аз 3 то 4 паёмҳои электронии охирине, ки шумо фиристодаед, пешниҳод кунед (аз дӯстон ё оилаатон хоҳиш кунед, ки ба паёмдони худ нигоҳ кунанд ва сатрҳои дақиқи мавзӯъҳои мактубҳои ба наздикӣ фиристодаатонро ба шумо бихонанд).
     • Provide the exact email addresses of contacts you recently emailed.
     • Таҷҳизоти ** Xbox Console-и худро таъмин кунед LiveDeviceID / Рақами силсилавӣ**, агар шумо боре ба Xbox бо он ҳисоби Microsoft ворид шуда бошед ва 4 рақами охир ва санаи анҷоми ҳама гуна корти кредитӣ, ки дар Дӯкони Microsoft / Skype / Office 365 истифода шудааст.

Phase 3: Damage control for secrets exposed inside your old emails¶

Пас аз он ки шумо ҳамлагарро маҳкам кардед ва ҳама қоидаҳо ва аломатҳои OAuth-ро тоза кардед, шумо бояд бо воқеияти судманди криминалистӣ рӯ ба рӯ шавед: агар ҳамлагар ба паёмдони шумо ҳатто 15 дақиқа дастрасии IMAP, OAuth ё веб дошта бошад, фарз кунед, ки онҳо дар тамоми бойгонии таърихии почтаи электронии шумо ҷустуҷӯи автоматии калимаи калидӣ анҷом додаанд.

Attackers do not read your 50,000 old emails manually. Their automated scripts immediately search your inbox for these exact ten high-value keywords and download every matching message and PDF attachment:

1. "seed", "mnemonic", "recovery phrase", "24 words", "wallet", "Coinbase", "Binance", "Ledger": If you ever emailed yourself a photo, text note, or encrypted zip of a cryptocurrency seed phrase or 2FA backup code, consider that wallet compromised immediately and move all funds to a brand-new hardware wallet.
2. "tax", "1040", "W-2", "1099", "SSN", "Social Security", "passport", "driver license", "mortgage", "closing": Loan applications, apartment leases, and CPA emails inside your inbox almost certainly contain PDFs with your unredacted Social Security Number (or national ID), date of birth, and driver's license photo. Place an immediate Credit Freeze with Equifax, Experian, and TransUnion (see our guide on identity theft response).
3. "password", "login", "credentials", "welcome to", "backup codes": Search your own inbox right now for the words password ва backup code, delete those dangerous plaintext emails after rotating every single password mentioned in them.
4. "invoice", "ACH", "wire", "routing", "escrow", "closing costs", "docusign": If you are in the middle of buying a house, paying a contractor, or running a business, the attacker now has copies of your real invoices and banking routing details and will attempt to impersonate you or your title company to steal the wire transfer. Call your real estate title company, escrow officer, or clients on the telephone immediately to warn them.

Саволҳои зуд-зуд додашаванда¶

Сарчашмаҳо тафтиш карда шуданд¶

• Cybersecurity and Infrastructure Security Agency (CISA, United States): Protecting Against Business Email Compromise (BEC), OAuth Application Abuse, and Phishing-Resistant MFA Guidance (cisa.gov/MFA ва cisa.gov).
• Microsoft Security Response Center & Defender Threat Intelligence (United States): Responding to a Compromised Email Account in Microsoft Defender for Office 365 (Hidden Inbox Rules -IncludeHidden, OAuth Consent Grants, and Session Revocation) (learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account).
• Google Account Security & Workspace Admin Help (United States): Secure a Hacked or Compromised Google Account, OAuth Third-Party Connections, and Advanced Protection Program (support.google.com/accounts/answer/6294825).
• National Cyber Security Centre (NCSC, United Kingdom): Recovering a Compromised Email Account and Mitigating Email Forwarding Rule Persistence (ncsc.gov.uk).
• Federal Trade Commission (FTC, United States): What To Do if Your Email Account Is Hacked (consumer.ftc.gov).
• Australian Cyber Security Centre (ACSC / ASD, Australia): Protecting Email Accounts and Detecting Unauthorized Inbox Rules (cyber.gov.au).

Дастурҳои алоқаманд¶

• Phishing and compromised accounts
• MFA phishing and adversary-in-the-middle bypass
• Бастани ВКД ва барқарорсозии аутентификатор
• Data breach response and password leaks
• Malware, ransomware, and spyware infection
• SIM swapping