Skip to content

Hack edilen e-poçta hasaby: gizlin ugratmak düzgünleri we dikeldiş

Gyssagly kömek belgileri ýurt boýunça tapawutlanýar. Bu sahypa ABŞ we Kanada üçin 911 belgisini ulanýar. Beýleki köp ýurt 112, 999 ýa-da başga bir belgini ulanýar. Yoururduňyz üçin belgini tapyň.

Esasy e-poçta hasabyňyz, sanly, maliýe we kanuny şahsyýetiňiziň skelet açarydyr. Ygtybarly sosial media profilinden ýa-da akym girişinden tapawutlylykda, döwülen Gmail, Microsoft Outlook / Microsoft 365, Yahoo, Apple iCloud Mail ýa-da ProtonMail hasaby bir hüjümçä bank hasaplaryňyzda, kriptografik alyş-çalyş bir exchangalarynda, pensiýa dellallarynda, salgyt portallarynda we bulut disklerinde ** "Paroly ýatdan çykardy" ** basmaga güýç berýär. Iň howply tarapy, ** diňe e-poçta parolyňyzy üýtgetmek we iki faktorly autentifikasiýa (2FA) açmak, çylşyrymly hüjümçini döwülen gutydan seýrek çykarýar. ** E-poçta hasabyna gireninden 30 sekundyň içinde häzirki hüjümçiler bäş gat sessiz tutanýerlilik meýdançasyny oturdýarlar: gizlin ** Gelýän bukjany süpürmek we ugratmak düzgünleri ** (köplenç atlandyrylýar) ., .., ýa-da [Blank] paroly täzeden düzýän e-poçtalary sessiz-üýnsüz göçürýär Trash ýa-da RSS Feeds bukjany, şonuň üçin olary hiç haçan görmersiňiz), ** Üçünji tarap OAuth Programma Grantlary ** (eM Client, Thunderbirdýa-da galp Google Docs Doly API-ni saklaýan programmalar, parolyňyza mätäç bolmazdan), ** Delegated poçta gutusy rugsatlary **, ** Programma parollary (IMAP/SMTP) **, we ** Dikeldiş e-poçta / Telefon belgisini çalyşmak **.

E-poçta ylalaşygynda fiziki zorluk, yzarlamak, öý zorlugy ýa-da kämillik ýaşyna ýetmedik adama zorlamak howpy abanýan bolsa, ýerli gyssagly kömek belgisine jaň ediň (911 ABŞ-da we Kanadada, 112 Europeanewropa Bileleşiginiň üsti bilen, 999 Angliýada) ýa-da halkara katalogymyza serediň gyssagly kömek belgileri derrew. Consumerhli sarp ediji we korporatiw poçta gutulary üçin aşakdaky 6 basgançakly ýok etmek yzygiderliligini takyk tertipde ýerine ýetiriň.

Indi et

  1. ** Infostealer wirusyndan şübhelenýän bolsaňyz, şol bir Windows PC ýa-da Mac-dan parolyňyzy üýtgetmäň **: E-poçtaňyzda eýýäm iki faktorly autentifikasiýa (2FA) açylan bolsa-da, kompýuteriňizde ** Infostealer zyýanly programma üpjünçiligi ýokaşmagy ähtimal (Lumma Stealer, RedLine ýa-da Atomic macOS Stealer) ýa-da zyýanly Chrome / Edge giňeldilen Chrome / EdgeSAPISID/SID Google-da ýa-da ESTSAUTH Microsoft-da). Parolyňyzy üýtgetmek we howpsuzlygy arassalamak üçin şu wagt ** arassa smartfon (iOS ýa-da Android) ** alyň.
  2. ** Parolyňyzy üýtgetmezden ozal (ýa-da 30 sekundyň içinde) Hasabyňyzy Dikeldiş E-poçta, Dikeldiş Telefon belgisini we MFA Autentifikator enjamlaryny barlaň we yzyna öwüriň **: Hüjümçiler howpsuzlyk sazlamalaryna derrew öz ýanýan telefon belgisini, bir gezek ulanylýan e-poçta salgysyny ýa-da gödek Authenticator programmasyny goşýarlar. Hüjümçiniň dikeldiş telefonyny ýa-da gödek açaryny pozmazdan parolyňyzy üýtgetseňiz, hüjümçi 10 sekuntdan soň "Paroly ýatdan çykardyňyz" düwmesine basar we sizi hemişelik gulplar.
  3. ** activehli işjeň giriş sessiýalaryny, dowamly brauzer gutapjyklaryny we programma parollaryny global derejede ýatyryň **: Paroly üýtgetmek elmydama bar bolan ykjam IMAP belliklerini ýa-da işjeň web sessiýa gutapjyklaryny derrew öldürmeýär. Google, Microsoft, Yahoo ýa-da Apple howpsuzlyk dolandyryş panelinde ** "deviceshli enjamlardan çykyň / seanslary ýatyryň" ** düwmesine aç-açan basyň we hasabyňyzdaky her 16 simwolly ** Programma parolyny pozuň.
  4. ** Iş stoly web brauzerini açyň (ykjam poçta programmasy däl) we ähli gizlin gutu düzgünlerini, süzgüçleri, awto-ekspeditorlary we süpürmek düzgünlerini pozuň **: Jübi poçta programmalary (Gmail ýa-da Outlook iOS / Android-de) ösen serwer taraplaýyn marşrut düzgünlerini ýygy-ýygydan gizleýärler. Web poçta sazlamalaryňyzy iş stolunyň brauzerinde açyň we ** Filtrleri we petiklenen salgylary **, ** Ibermek we POP / IMAP **, we ** Düzgünler / Süpürmek ** barlaň. Poçta daşardan ugrukdyrýan ýa-da şuňa meňzeş sözleri öz içine alýan e-poçtalary awtomatiki göçürýän islendik düzgüni pozuň "bank", "code", "reset", "security", "wire", "invoice", ýa-da "crypto" the Trash, Archive, ýa-da RSS Feeds bukjasy.
  5. ** Üçünji tarap OAuth birikdirilen programmalary we poçta gutusynyň wekillerini yzyna alyň **: Hasabyňyzyň ** Üçünji tarap programmalary we hyzmatlary ** (Google) ýa-da ** Giriş programmalary we hyzmatlary ** (Microsoft / Yahoo) -a geçiň we her bir programmany ýatyryň Mail.Read, Mail.ReadWrite, ýa-da Gmail API rugsatlar, üstesine-de barlaň ** Hasabyňyza ygtyýar beriň (Delegasiýa) ** şonuň üçin hüjümçi parol üýtgeşmelerini düýbünden äsgermezlik edýän OAuth belligi arkaly poçta gutyňyzy okap bilmez.
  6. ** Barlaň Trash (Bin), Sent, we Spam Hüjümçiniň haýsy maliýe ýa-da kripto hasaplaryny täzeden başlandygyny görmek üçin bukjalar **: Hüjümçiler 6 sanly tassyklama koduny alandan soň bankyňyzdan, Coinbase / Binance, Amazon, PayPal ýa-da Steam-dan gelýän howpsuzlyk duýduryşlaryny pozýarlar. Aç Trash we Sent bukjalar: şu wagt oturan her bir paroly täzeden düzýän e-poçta Trash hüjümçiniň eýýäm bozan ýa-da bozmaga synanyşan hasabydyr.

Danger

Näme üçin bankyňyz, PayPal ýa-da kripto alyş-çalşygyňyz ogurlanýarka size 10 sany howpsuzlyk duýduryş e-poçta iberendigini görmediňizmi? Hüjümçiniň döwülen Gmail ýa-da Outlook poçta gutusynyň içinde eden ilkinji işi ** Sessiz basyş düzgüni döretmekdir (mysal üçin: * Iberiji öz içine alýan bolsa @chase.com, @coinbase.com, @paypal.comýa-da mowzuk öz içine alýar Verification Code, Security Alert, Password, Login -> Okaň diýip belläň we poçta gutusyna geçiň we hapa / arhiw / RSS iýmitlerine geçiň *). Ilki bilen ** Düzgünler / Süzgüçler ** goýmasyny we ** Zibil / Arhiw ** bukjalaryňyzy barlaň, esasy Gelýän bukjanyňyz hüjümçi tarapyndan bilkastlaýyn senzura edilýär.

Karar agajy: gözegçiligi gaýtadan dikeltmek we tutanýerliligi arassalamak

Gelýän bukjanyňyza girip bilýärsiňizmi ýa-da hüjümçi tarapyndan doly gulplandyňyzmy, ädimme-ädim üçburç agajyna eýeriň:

flowchart TD
    A["Güman edilýän ýa-da tassyklanan e-poçta hasaby ylalaşygy"] --> B{"E-poçta hasabyňyza şu wagt girip bilersiňizmi?"}
    B -->|"Hawa: Entegem girip bilýärin"| C["Arassa smartfona geçiň (Potensial ýokaşan kompýuterden gaça duruň)"]
    C --> D["1. Hüjümçiniň Dikeldiş Telefonyny, Dikeldiş E-poçta we Rogue MFA Passkeys-i aýyryň"]
    D --> E["2. Paroly üýtgeşik 20+ Char parol sözüne üýtgediň we Fişing-çydamly 2FA-ny işlediň"]
    E --> F["3. 'Devhli enjamlardan çykmak' düwmesine basyň we 16-Char programma parollarynyň hemmesini pozuň"]
    F --> G["4. Iş stolunyň web poçtasyny açyň: Gizlin ugradyşy, süzgüçleri, süpüriş düzgünleri we wekilleri arassalaň"]
    G --> H["5. OAuth Üçünji tarap programmalaryny ýatyryň we daşarky hasaplar üçin hapa / iberilen bukjalary barlaň."]
    B -->|": Ok: Hüjümçi paroly we dikeldiş telefonyny / MFA üýtgetdi"| I{"E-poçta hasabynyň haýsy görnüşi gulplandy?"}
    I -->|"Iş / mekdep / korporatiw domen (@ company.com)"| J["Derrew IT administratory bilen habarlaşyň: Admin MFA-ny täzeden dikeldip biler, Tokenleri ýatyryp we Admin konsoly arkaly 60 sekuntda girişi dikeldip biler"]
    I -->|"Şahsy Gmail / Outlook.com / Yahoo / iCloud"| K["Taryhy öýüňizdäki Wi-Fi IP we tanyş brauzer / telefonyňyzdan awtomatlaşdyrylan hasaby dikeltmek formasyny işlediň"]
    K --> L["Şol e-poçta bagly hasaplary doňdurmak üçin derrew banklaryňyza, ykjam aragatnaşyk kärhanasyna we kripto alyş-çalyşlaryna jaň ediň"]

1-nji etap: E-poçta üpjün edijisi tarapyndan çuňňur arassa tutanýerlilik barlagy (Gmail, Outlook / M365, Yahoo, iCloud)

Her bir esasy e-poçta üpjün edijisi ugratmak düzgünlerini, süzgüçleri, OAuth belliklerini we poçta gutusynyň wekillerini birneme başga menýularda saklaýar. Kompýuteriňizde “Apple Mail” ýa-da “Outlook Desktop” -y ulanýan bolsaňyzam, bu serweriň sazlamalaryny görmek üçin prowaýderiň resmi web poçta interfeýsine iş stoly brauzerine girmeli ** (ýa-da ykjam brauzeriňizdäki “Iş stoly” talap etmeli).

Dowamlylyk mehanizmi Google Gmail / Google Iş meýdany Microsoft Outlook.com / Microsoft 365 Yahoo poçta / AOL poçta Apple iCloud Mail
** 1. Dikeldiş maglumatlary we MFA enjamlary ** myaccount.google.com/security -> ** 2 basgançakly barlamak **, ** Passkeys **, ** Dikeldiş telefony **, ** Dikeldiş e-poçta **. account.microsoft.com/security -> ** Nädip girýändigimi dolandyryň ** (Şahsy) ýa-da mysignins.microsoft.com/security-info (Iş / mekdep). login.yahoo.com/myaccount/security -> ** Iki basgançakly barlamak **, ** Dikeldiş telefon belgileri **, ** Dikeldiş e-poçta salgylary **. account.apple.com -> ** Giriş we Howpsuzlyk ** -> ** Hasap howpsuzlygy ** (Ynamly telefon belgileri we ygtybarly enjamlar).
** 2. Allhli sessiýalardan çykmak ** myaccount.google.com/device-activity -> Her nätanyş enjamy basyň -> ** Çykyň **. account.microsoft.com/security -> ** Meni hemme ýerde çykaryň ** (sarp edijide 24 sagada çenli wagt; Entra ID-de dessine Revoke sessions). login.yahoo.com/myaccount/activity -> ** Soňky işjeňlik ** -> ** Nätanyş ýerlerden / brauzerlerden çykyň. Settings -> [Your Name] iPhone-da -> Enjamlaryň sanawyna aşak aýlaň -> Nätanyş enjama degiň -> ** Hasapdan aýyryň **.
** 3. Gizlin guty düzgünleri we süzgüçler ** Gmail Web -> ** Sazlamalar (Dişli) ** -> ** settingshli sazlamalara serediň ** -> ** Filtrler we petiklenen salgylar ** goýmasy. Outlook Web -> ** Sazlamalar (Dişli) ** -> ** Poçta ** -> ** Düzgünler **, we ** Poçta ** -> ** Süpürmek **, we ** Gerek däl e-poçta ** (Bloklanan iberijiler). Yahoo Web -> ** Sazlamalar (Dişli) ** -> ** Has köp sazlamalar ** -> ** Filtrler **. icloud.com/mail -> ** Sazlamalar (Poçta sanawynyň ýokarsyndaky dişli) ** -> ** Sazlamalar ** -> ** Düzgünler **.
** 4. Awto-ugradyş we POP / IMAP ** Gmail Web -> ** Sazlamalar ** -> ** settingshli sazlamalara serediň ** -> ** Ibermek we POP / IMAP ** goýmasy. Outlook Web -> ** Sazlamalar (Dişli) ** -> ** Poçta ** -> ** Ibermek ** (we ** Ibermek we IMAP **). Yahoo Web -> ** Sazlamalar ** -> ** Has köp sazlamalar ** -> ** Poçta gutulary ** -> E-poçta salgyňyzy basyň -> ** Öňe **. icloud.com/mail -> ** Sazlamalar (Dişli) ** -> ** Sazlamalar ** -> ** Ibermek ** (Forward my email to).
** 5. Poçta gutusynyň wekiliýeti we lakamlary ** Gmail Web -> ** Sazlamalar ** -> ** settingshli sazlamalara serediň ** -> ** Hasaplar we import ** -> Barlaň ** Hasabyňyza rugsat beriň ** & ** Poçta ** görnüşinde iberiň. Microsoft 365 alyş-çalyş dolandyryş merkezi -> ** Poçta gutulary ** -> ** Delegasiýa ** (Read and manage / Send as / Send on behalf). Yahoo Web -> ** Sazlamalar ** -> ** Has köp sazlamalar ** -> ** Poçta gutulary ** -> ** Diňe e-poçta salgysyny iberiň ** & ** Bir gezek ulanylýan salgylar **. icloud.com/mail -> ** Sazlamalar ** -> ** Salgylar ** (Rugsat berilmedik iCloud lakamlaryny barlaň ýa-da jogap bermek-ýok etmek).
** 6. Üçünji tarap OAuth programmalary we programma parollary ** myaccount.google.com/connections (OAuth programmalary) & myaccount.google.com/apppasswords (16 belgili IMAP parollary). account.live.com/consent/Manage (Şahsy OAuth) ýa-da myapps.microsoft.com (Iş) + ** Howpsuzlyk bölüminde programma parollary **. login.yahoo.com/myaccount/security -> ** Programma parollary ** & ** Daşarky birikmeler **. account.apple.com -> ** Giriş we Howpsuzlyk ** -> ** Programma mahsus parollar ** -> ** Hemmesini ýatyryň **.

Detailed Walkthrough 1: Purging a Hacked Google / Gmail Account

When cleaning a compromised Gmail or Google Workspace account, work through these exact seven tabs without skipping a single one:

  1. Audit Security & Passkeys (myaccount.google.com/security):
    • Click Passkeys and security keys: Attackers immediately register a synced passkey or virtual authenticator on their own browser so they can log back in with zero password and zero SMS prompt. Delete any passkey you do not recognize with 100 percent certainty.
    • Click 2-Step Verification -> check Authenticator, Google Prompt devices, Recovery phone, and Backup codes. Click Generate new codes to immediately invalidate any 8-digit backup codes the attacker screenshotted.
  2. Destroy Active App Passwords (myaccount.google.com/apppasswords):
    • An App Password is a 16-letter passcode that lets an IMAP mail client (like Thunderbird or a hacker's Python script) download your entire inbox forever while completely bypassing 2-Step Verification. Delete every App Password listed.
  3. Revoke Third-Party OAuth Connections (myaccount.google.com/connections):
    • Look for any application granted access to Gmail, Google Drive, or Google Contacts (attackers often use legitimate-looking mail clients like eM Client, Newton Mail, Cleanfox, or custom OAuth scripts). Click the app -> Delete all connections you have with [App Name].
  4. Check Gmail Accounts and Import Tab (Mail Delegation & Reply-To Hijacking):
    • In Gmail on a desktop computer, click the Gear icon -> See all settings -> Accounts and Import.
    • Under Grant access to your account, verify that ZERO email addresses are listed. A delegated user can read, send, and delete your emails without knowing your password.
    • Under Send mail as, click edit info next to your own name and verify the attacker did not insert a secret Specify a different "reply-to" address (for example, setting your Reply-To to yourname.company@gmail.com or an attacker lookalike domain so that whenever someone replies to your legitimate emails, their reply goes to the hacker instead of you).
  5. Check Gmail Filters and Blocked Addresses Tab:
    • Look closely at every filter. Attackers often create filters matching from:(a|e|i|o|u) ýa-da size > 0 ýa-da has:attachment or keywords like invoice, wire, bank, security, alert, code with the action Skip the Inbox (Archive it), Mark as read, Delete it, or Forward it to:. Delete every unfamiliar filter.
  6. Check Gmail Forwarding and POP/IMAP Tab:
    • Verify Forwarding is set to Disable forwarding, remove any unrecognized forwarding address from the dropdown list, and set IMAP access to Disable IMAP (unless you specifically use a secure desktop client).
  7. Check Google Drive Trash & Google Takeout History:
    • Attackers frequently trigger a Google Takeout (takeout.google.com) archive to download a .zip of all your emails, Google Photos, and Google Drive documents, including tax returns and password lists. Visit takeout.google.com right now: if you see an active or completed export you did not request, click Cancel export and see exactly which data categories were packaged.

Detailed Walkthrough 2: Purging a Hacked Microsoft Outlook.com / Hotmail / Microsoft 365 Account

Microsoft accounts (@outlook.com, @hotmail.com, @live.com, @msn.com, and corporate Microsoft 365 Exchange Online mailboxes) have several unique hiding spots that attackers exploit during Business Email Compromise (BEC) and consumer hacks:

  1. The Hidden RSS Feeds we Conversation History Folder Trap:
    • In Outlook, attackers rarely route suppressed emails into the main Deleted Items folder because users check Deleted Items. Instead, they create an Outlook Rule named . ýa-da 1 gelýän e-poçtalary -e geçirýärRSS Feeds, Archive, or Conversation History bukjany we okalan ýaly bellik edýär. Çep gapdaldaky her bukjany barlaň, esasanam RSS Feeds, edil şu wagt.
  2. ** Ikisine-de gözegçilik Rules WE Sweep Outlook Web-de (outlook.live.com ýa-da outlook.office.com)**:
    • ** Sazlamalar dişli ** (ýokarky sagda) -> ** Poçta ** -> ** Düzgünler ** basyň. Döredmedik düzgünleriňizi pozuň.
    • Hüjümçiniň düzgüniniň aşagyndaky bellik gutusyna üns beriň: Stop processing more rules. Hüjümçiler bu gutujygyny ýokarky düzgüninde barlaýarlar, şonuň üçin kanuny düzgünleriňiziň hiç biri işlemeýär.
    • Ondan soň, ** Poçta ** -> ** Süpürmek ** we ** Poçta ** -> ** Gereksiz e-poçta ** -> ** Bloklanan iberijiler we domenler ** basyň. Hüjümçiler yzygiderli goşýarlar @microsoft.com, @google.com, @apple.com, @chase.com, @bankofamerica.com, we @coinbase.com ** Bloklanan iberijiler we domenler ** sanawyňyza howpsuzlyk duýduryşlary çykýar ýa-da sessiz-üýnsüz gidýär. Bloklanan iberijiler sanawyňyzy islendik kanuny kompaniýalardan arassalaň.
  3. ** Barlaň Mail -> Forwarding and IMAP**:
    • ** Ibermegi işjeňleşdiriň ** barlanmadygyna göz ýetiriň. Hüjümçiniň e-poçta salgysy gutyda oturan bolsa "Keep a copy of forwarded messages" barlanmadyk bolsa, size iberilen her bir e-poçta hakere iberilýärdi we poçta gutyňyzdan girmezden ozal poçta gutyňyzdan öçürilýärdi.
  4. ** Korporatiw Microsoft 365 dolandyryjylary üçin: Gizlin MAPI / Korrupsiýa gutujy düzgünlerini açmak üçin PowerShell-i işlediň (MFCMAPI)**:
    • Çylşyrymly BEC howp abanýanlary alyş-çalyş web hyzmatlary (EWS) API ýa-da ulanýarlar MFCMAPI ** gizlin bozulan poçta gutusynyň düzgünlerini döretmek üçin ** PR_RULE_MSG_NAME we PR_RULE_MSG_PROVIDER MAPI häsiýetleri) Outlook Web GUI ýa-da adaty alyş-çalyş dolandyryş merkezinde ** asla görkezilmeýär.
    • IT dolandyryjysy ** Exchange Online PowerShell ** -e birikmeli we işlemeli: 
      Get-InboxRule -Mailbox victim@yourdomain.com -IncludeHidden | Format-List Name,Enabled,Description,ForwardTo,ForwardAsAttachmentTo,RedirectTo,DeleteMessage,MoveToFolder
    • ** goşmak-IncludeHidden** baýdak poçta gutusynyň Associated Contents tablisasynda gizlenýän MAPI düzgünlerini paş edýär (FAIarkaly arassalap bolýar Remove-InboxRule -Mailbox victim@yourdomain.com -Identity "<RuleID>" ýa-da işe girizmek arkaly outlook.exe /cleanrules.
    • Şeýle hem ** Kärendeçi derejeli alyş-çalyş transport düzgünleri (Poçta akymynyň düzgünleri) ** arkaly gözden geçiriň Get-TransportRule: eger hüjümçi Bir Exchangea Dolandyryjysynyň hasabyny bozsa, şahsy poçta gutusy düzgünini däl-de, bütin dünýäde poçta akymynyň düzgünini döreden bolmagy mümkin.

Warning

Näme üçin parolymy üýtgedip, iki faktorly tanamaklygy açanymdan soň hüjümçi e-poçtaňyza girdi? ** Ogurlanan sessiýa gutapjyklaryny gaýtalamak (Infostealer zyýanly programma üpjünçiligi) ** ýa-da ** Zyýanly brauzer giňeltmeleri **. Garakçylyk programmasyny, galp PDF / faktura guralyny, galp wideo kodekini ýa-da Windows PC ýa-da Mac-da zyýanly Chrome giňeltmesini göçürip alan bolsaňyz, zyýanly programma üpjünçiligi şifrlenen SQLite Cookie maglumatlar bazasyny brauzeriňizden göçürýär (%LocalAppData%\Google\Chrome\User Data\Default\Network\Cookies). Gutapjyklaryňyzy anti-detekt brauzerine import edip, hüjümçi parolyňyzdan we 2FA-dan geçýär. Kompýuteriňizde zyýanly programma üpjünçiliginden şübhelenýän bolsaňyz, gollanmamyza serediň zyýanly programma üpjünçiligi, töleg programma üpjünçiligi we içaly programma üpjünçiligi we şol kompýuterdäki e-poçtaňyza girmezden ozal OS-yňyzy arassalaň.

2-nji tapgyra: Eger doly gulplanan bolsaňyz näme etmeli (Hüjümçi paroly üýtgetdi & 2FA)

Hüjümçi eýýäm parolyňyzy üýtgeden bolsa, dikeldiş telefon belgiňizi öz adyna çalşyp, öz Autentifikator programmasyny ýa-da apparat açaryny açan bolsa, her minut hasaplanýar, sebäbi hüjümçi gulplanan wagtyňyz baglanyşyk hasaplaryňyzy işjeň talaýar.

1-nji ädim: Ilki bilen hüjümçiniň maliýe güýjüni kesiň (Ilkinji 15 minut)

Haker ogurlanan gutyňyzy ulanyp, bank hasabyňyzy boşadanda, awtomatiki e-poçta dikeldiş formasyna garşy üç sagat wagt sarp etmäň:

  1. ** Telefon arkaly banklaryňyza, kredit kartoçkalaryny we maýa goýum dellallaryna jaň ediň **:
    • Galplyk bölümine aýdyň: * "Esasy e-poçta adresim [siziň@email.com] bozuldy we men häzir gulplandym. Profilime derrew dilden parol / howpsuzlyk doňdurmasy goýuň, işjeň web / ykjam sessiýalary ýatyryň we şol e-poçta salgysyny öz-özüňe parol täzeden düzmekden aýyryň." *
  2. ** Jübi telefon göterijiňiziň hasabyny yzarlaýan SIM çalşygyna garşy gulplaň **:
    • Hüjüm edilen gutyňyzyň içinde hüjümçi aýlyk AT&T, Verizon, T-Mobile, Rogers, Vodafone ýa-da O2 tölegleriňizi okap, jübi hasabyňyzyň belgisini we töleg salgysyny berip biler. ** Nomer geçirmek PIN / Port doňdurma ** we Hasap kodynyň gulplandygyny barlamak üçin operatoryňyza derrew jaň ediň.
  3. ** Cryptocurrency alyş-çalyş hasaplaryňyzy doňduryň (Coinbase, Binance, Kraken, Gemini)**:
    • Esasy alyş-çalyşlaryň köpüsi, e-poçtaňyz bozulan halatynda bir gezek basmak ýa-da gyssagly telefon ** Hasap gulpy ** üpjün edýär (mysal üçin, Coinbase awtomatiki gyssagly gulplamak +1 (888) 908-7930 ABŞ / Halkara ýa-da +44 808 168 4635 Angliýada).
  4. ** Entek girip boljak her hasapda hasaba alnan e-poçta salgysyny üýtgediň **:
    • “Amazon”, “PayPal”, “Venmo”, “Steam”, “Discord”, “Apple ID” -e we häzirki wagtda smartfon programmaňyzdaky parol dolandyryjyňyza ** giren bolsaňyz gerek. Täze, arassa gyssagly e-poçta hasaby dörediň (mysal üçin, ProtonMail-de ýa-da apparat açary bilen üpjün edilen täze Gmail-de) we kontakt e-poçtaňyzy hüjümçi täzeden dikeltmezden ozal giren programmalaryňyzyň programma sazlamalaryna giriň.

2-nji ädim: Awtomatlaşdyrylan hasaby dikeltmek algoritmlerini nädip geçirmeli (Google, Microsoft, Yahoo)

Mugt sarp ediji e-poçta hasaplary üçin (@gmail.com, @outlook.com, @hotmail.com, @yahoo.com), adam goldaw agentlerine parollary el bilen täzeden dikeltmek ýa-da telefonda 2FA aýlanyp geçmek (sosial in engineeringenerçiligiň öňüni almak) in engineeringenerçilik gözegçiligi tarapyndan düýbünden gadagan edilýär. Munuň ýerine dikeldiş awtomatlaşdyrylan ** Töwekgelçilik we şahsyýeti kesgitlemek motory ** bilen dolandyrylýar. Kriptografiki ynam balyňyzy ulaltmak we gizlenen ** "7 günlük / 30 günlük howpsuzlyk saklamagy ýokaşdyrmak" **:

  1. ** MÖHÜM DÜZGÜN: Dikeldiş formasyny takyk taryhy enjamyňyzdan, brauzeriňizden we öý Wi-Fi IP adresiňizden iberiň **:
    • Hiç haçan işleme accounts.google.com/signin/recovery ýa-da account.live.com/acsr öýjükli maglumatlardaky ýa-da VPN arkaly täze inkognito brauzer penjiresinden.
    • ** adaty noutbuk, iş stoly ýa-da smartfon ** we ** takyk brauzeri (gutarnykly gutapjyklar / ýerli ammar bilen) ** ulanyp, soňky bir ýylyň dowamynda her gün şol e-poçta hasabyňyza gireniňizde, adaty öýüňize ýa-da ofisiňiz Wi-Fi marşrutizatoryna ** (**) birikdiriň.ASN we geolokasiýa laýyklygy). Dikeldiş algoritmi enjamyň barmak yzlary belliklerine agyr agram berýär (DeviceID) we taryhy IP subnetleri.
  2. ** Google / Gmail Dikeldiş (accounts.google.com/signin/recovery)**:
    • Hüjümçi dikeldiş telefonyňyzy we dikeldiş e-poçtaňyzy birnäçe sekunt öň üýtgeden hem bolsa, ** Google hüjümçi olary üýtgedeninden soň takmynan 7 senenama güni (168 sagat) ** dogry dikeldiş faktorlary hökmünde PREVIOUS dikeldiş telefon belgiňizi we PREVIOUS dikeldiş e-poçta salgysyny saklaýar.
    • Soralanda signin/recovery, * asyl * telefon belgiňize ýa-da * asyl * dikeldiş e-poçta salgysyna kod ibermegi teklip edýänçä ýa-da ** Google Prompt ** arkaly ozal hasaba alnan Android telefonyňyzy / iPhone-yňyzy görkezýänçä ** "Başga ýoly synap görüň" düwmesine basyň.
    • ** Google One-a (Tölegli bulut ammary) ýa-da YouTube Premium / YouTube kanalyna ýazylsaňyz **:
      • Tölegli ** Google One ** abonentleriniň janly adam ** Google One goldawy (one.google.com/support) ** gulplanan hasaplary içerde köpeldip biljek.
      • Eger döwülen Google hasabyňyzda ** YouTube kanaly ** bar bolsa, habarlaşyň **@TeamYouTube X-da (öňki Twitter) ** derrew aç-açan. Adaty Gmail-den tapawutlylykda, @TeamYouTube Döredijiniň goldawy, Google-yň asyl we tassyklaýan howpsuzlyk inersenerleri tarapyndan synag edilen ** Hacked Hasaby Eskalasiýa Formasy bilen üpjün edýär. Channel ID (UC..), AdSense ID we hüjümçiniň açarlaryny / MFA-ny fiziki taýdan aýyrmak we 24-72 sagadyň dowamynda ähli Google / Gmail hasabyňyzy dikeltmek üçin IP taryhyny ýükläň.
  3. ** Microsoft Outlook / Hotmail / Xbox hasaby dikeltmek (account.live.com/acsr)**:
    • First, try logging in and clicking "I don't have any of these" at the 2FA screen: if you have a 25-character Microsoft Recovery Code saved when you originally set up your account, entering it lets you replace the attacker's security info (subject to Microsoft's mandatory 30-day security info replacement waiting period, during which the attacker can also be blocked if you flag the account).
    • When filling out the **Microsoft Account Recovery Form (account.live.com/acsr) ** öýüňizdäki Wi-Fi IP-den:
      • Provide the exact Subject lines of 3 to 4 recent emails you sent (ask friends or family to look in their own inbox and read you the exact character-for-character Subject lines of emails you sent them recently).
      • Recentlyakynda e-poçta iberen aragatnaşyklaryňyzyň takyk e-poçta salgylaryny beriň.
      • Provide your Xbox Console Hardware LiveDeviceID / Serial Number if you ever signed into an Xbox with that Microsoft account, and the last 4 digits and expiration date of any credit card ever used on Microsoft Store / Skype / Office 365.

Tip

Once you regain access to a hacked email account, check your Sent folder and your Trash folder for extortion or scam emails sent by the attacker to your contacts. Attackers often scan your inbox for sensitive photos, tax documents, or business invoices, and send fake "urgent gift card / wire transfer" emails to your friends, elderly parents, or clients. Send a clear warning email (and text message) to anyone the attacker messaged during the breach window.

Phase 3: Damage control for secrets exposed inside your old emails

Once you have locked the attacker out and cleaned all rules and OAuth tokens, you must confront a sobering forensic reality: if the attacker had IMAP, OAuth, or web access to your mailbox for even 15 minutes, assume they ran an automated keyword search across your entire historical email archive.

Attackers do not read your 50,000 old emails manually. Their automated scripts immediately search your inbox for these exact ten high-value keywords and download every matching message and PDF attachment:

  1. "seed", "mnemonic", "recovery phrase", "24 words", "wallet", "Coinbase", "Binance", "Ledger": Eger özüňize surat, tekst belligi ýa-da cryptocurrency tohum jümlesiniň ýa-da 2FA ätiýaçlyk kodunyň kodlanan zipini e-poçta bilen iberen bolsaňyz, gapjygyň derrew bozulandygyny göz öňünde tutuň we ähli serişdeleri täze enjam gapjygyna geçiriň.
  2. "tax", "1040", "W-2", "1099", "SSN", "Social Security", "passport", "driver license", "mortgage", "closing": Loan applications, apartment leases, and CPA emails inside your inbox almost certainly contain PDFs with your unredacted Social Security Number (or national ID), date of birth, and driver's license photo. Place an immediate Credit Freeze with Equifax, Experian, and TransUnion (see our guide on identity theft response).
  3. "password", "login", "credentials", "welcome to", "backup codes": Search your own inbox right now for the words password we backup code, delete those dangerous plaintext emails after rotating every single password mentioned in them.
  4. "invoice", "ACH", "wire", "routing", "escrow", "closing costs", "docusign": If you are in the middle of buying a house, paying a contractor, or running a business, the attacker now has copies of your real invoices and banking routing details and will attempt to impersonate you or your title company to steal the wire transfer. Call your real estate title company, escrow officer, or clients on the telephone immediately to warn them.

Freygy-ýygydan berilýän soraglar

I changed my email password and turned on 2FA, yet the hacker is STILL sending emails from my account. How is that possible?

There are four technical mechanisms that survive a password change and 2FA setup: **1. Active Third-Party OAuth Tokens**: The hacker connected an OAuth application (like `eM Client`, `Thunderbird`, or a malicious script) to your account; OAuth tokens authenticate via API refresh tokens and never check your password again until you explicitly revoke the app at `myaccount.google.com/connections` or `account.live.com/consent/Manage`. **2. 16-Character App Passwords**: The hacker generated an IMAP/SMTP App Password in your security settings, which bypasses 2FA completely. **3. Mailbox Delegation**: In Gmail (`Settings -> Accounts and Import -> Grant access to your account`) or Microsoft 365 Exchange Delegation, the hacker added their own account as a delegate. **4. Infostealer Malware on Your PC**: Your computer has a trojan stealing the live session cookie from your web browser every time you log in with your new password.

Why am I suddenly receiving 500 to 5,000 random newsletter sign-up emails per hour ("Email Bombing")?

If your inbox suddenly explodes with thousands of automated *"Confirm your newsletter subscription"* emails in every language from random websites around the world, **you are under an active "Subscription Bomb" (Email Bombing) attack.** Do NOT bulk-delete your entire inbox without looking closely. Attackers launch a Subscription Bomb to bury **one specific, critical email** that arrived right at the start of the flood, such as an **Apple Store / Best Buy $3,000 laptop order confirmation**, a **Bank Wire Transfer alert**, a **Zelle / PayPal transfer receipt**, or a **Mobile Carrier SIM Swap notification**. Use your email search bar immediately to filter for: `subject:(order OR receipt OR wire OR transfer OR password OR security OR alert OR SIM)` or check your bank, credit card, Amazon, Walmart, and mobile carrier accounts right now to find the single fraudulent transaction they are trying to hide in the noise.

Can an attacker hack my email just by me opening and reading an email without clicking any links or downloading attachments?

In modern webmail (Gmail, Outlook Web, Yahoo, Apple Mail on updated iOS/macOS), simply opening and reading a plain text or HTML email does **not** hand over your password or infect your device, provided your operating system and browser are up to date. The only thing opening an email can reveal to a sender is a **Tracking Pixel** (an invisible 1x1 pixel external image that tells a spammer your email address is active and reveals the rough IP address of the mail proxy, though Apple Mail Privacy Protection and Gmail image proxies now mask even your real IP). Almost 100 percent of email takeovers come from **1. Credential Reuse** (reusing a password leaked in another website's data breach), **2. Adversary-in-the-Middle (AitM) Phishing Links** (clicking a fake login link), or **3. Infostealer Malware** executed on a PC.

Why did I get an email from MY OWN email address saying a hacker recorded me through my webcam (`Pegasus` / Trojan extortion email)?

If you received an email that appears to be sent **`From: your_own_email@domain.com` `To: your_own_email@domain.com`** claiming a hacker installed "Pegasus spyware" or recorded you via your webcam while browsing adult websites and demanding $500 to $2,000 in Bitcoin, **your email and computer were NOT hacked.** This is a mass-automated **SMTP Header Spoofing scam**. Basic email protocols allow any spam server to type your address into the visual `From:` display header (just like writing a fake return address on a paper envelope). If you check your **`Sent`** folder, you will see that email is not in your `Sent` folder, and if you click **"Show Original" / "View Message Source"**, you will see `SPF: FAIL` or `DMARC: FAIL` from a foreign server IP. Delete the email and never pay.

What is the safest type of Two-Factor Authentication (2FA) to put on my email so it can never be phished or SIM-swapped?

Move away from **SMS Text Message 2FA** (which can be stolen via a SIM swap) and even standard 6-digit TOTP Authenticator codes (which can be intercepted in real time if you accidentally type them into an Adversary-in-the-Middle `Evilginx` phishing page). Instead, enable **FIDO2 / WebAuthn Passkeys or Physical Hardware Security Keys (such as a YubiKey 5 Series or Google Titan Key)**. Because FIDO2 cryptographic signatures are mathematically bound to the genuine browser domain (`google.com` or `login.live.com`), a FIDO2 hardware key or passkey makes it cryptographically impossible for an attacker to phish your login, even if you click a sophisticated fake login link. Enroll at least **two** hardware keys (one primary on your keychain, one backup in a fireproof safe) and enable **Google Advanced Protection Program (`landing.google.com/advancedprotection`)** if you are a high-risk target.

Should I permanently abandon my old email address after a hack and create a brand-new one?

If you thoroughly purge all 6 persistence points (Recovery info, Active sessions, App Passwords, OAuth grants, Filters/Forwarding rules, and Delegation) and lock the account with a strong unique password and FIDO2 MFA, **the technical security of the account is 100 percent restored.** However, you should still ** keep the old email account open and locked down forever** rather than deleting it. If you delete an old `@outlook.com`, `@yahoo.com`, or custom domain email address, an attacker may eventually re-register that recycled username and use it to reset forgotten accounts tied to it. Many security professionals keep their old address locked with a hardware key as a decoy/legacy inbox while migrating their **banking, brokerage, tax, and cryptocurrency logins** to a brand-new, private, unpublicized email address (`myname-vault@proton.me` or a dedicated Gmail) that is never given out on shopping sites, newsletters, or social media.

Çeşmeler barlandy

  • Cybersecurity and Infrastructure Security Agency (CISA, United States): Protecting Against Business Email Compromise (BEC), OAuth Application Abuse, and Phishing-Resistant MFA Guidance (cisa.gov/MFA we cisa.gov).
  • Microsoft Security Response Center & Defender Threat Intelligence (United States): Responding to a Compromised Email Account in Microsoft Defender for Office 365 (Hidden Inbox Rules -IncludeHidden, OAuth Consent Grants, and Session Revocation) (learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account).
  • Google Account Security & Workspace Admin Help (United States): Secure a Hacked or Compromised Google Account, OAuth Third-Party Connections, and Advanced Protection Program (support.google.com/accounts/answer/6294825).
  • National Cyber Security Centre (NCSC, United Kingdom): Recovering a Compromised Email Account and Mitigating Email Forwarding Rule Persistence (ncsc.gov.uk).
  • Federal Trade Commission (FTC, United States): What To Do if Your Email Account Is Hacked (consumer.ftc.gov).
  • ** Awstraliýanyň kiberhowpsuzlyk merkezi (ACSC / ASD, Awstraliýa) **: * E-poçta hasaplaryny goramak we rugsatsyz gutu düzgünlerini kesgitlemek * (cyber.gov.au).

Degişli gollanmalar