carmen617
Well-Known Member
- Reaction score
- 687
- Location
- Boston, MA
Client fell for a phish and hacker logged onto his outlook.com email to scam his contacts. By the time I was called in to help the client had already changed his password. I logged into outlook.com and found filters redirecting any mail to an archive folder, showed it to client, deleted the filters. No forwarding address had been created, and no auto response was set up. We went into client's Microsoft security settings and saw that his account had been logged into from Nigeria, twice using Chrome and once using Active Exchange. I had him change the password again, and we enabled 2FA.
Client is getting his own email on Outlook 2010 using Active Exchange and I noticed that we did not have to update his password in Outlook 2010 - mail kept flowing. Even after two password changes and enabling 2FA. While I was working on his system we saw a new sent email from the hacker, to one of the client's contacts, assuring him that the email was legit and this retired college professor needed his friend to send him a gift card. Also while I was working on the client's system, we saw the archive folder get moved to the trash, and then saw the trash get emptied. Hacker clearly still has access to this email account after 2 password changes and 2FA being turned on, and that has to be via Exchange.
Microsoft offers a way to "sign out of all trusted devices" but that didn't end my client's access to his email on Outlook 2010, and it doesn't seem to have ended the hacker's access either. I am out of ideas - Microsoft doesn't offer any way to end all active sessions, period. I actually advised my client to call Microsoft and tell them that he changed password multiple times and enacted 2FA and both his Outlook 2010 and the hacker's Active Exchange access have not been interrupted. Anybody have any idea what else we can do here?
Client is getting his own email on Outlook 2010 using Active Exchange and I noticed that we did not have to update his password in Outlook 2010 - mail kept flowing. Even after two password changes and enabling 2FA. While I was working on his system we saw a new sent email from the hacker, to one of the client's contacts, assuring him that the email was legit and this retired college professor needed his friend to send him a gift card. Also while I was working on the client's system, we saw the archive folder get moved to the trash, and then saw the trash get emptied. Hacker clearly still has access to this email account after 2 password changes and 2FA being turned on, and that has to be via Exchange.
Microsoft offers a way to "sign out of all trusted devices" but that didn't end my client's access to his email on Outlook 2010, and it doesn't seem to have ended the hacker's access either. I am out of ideas - Microsoft doesn't offer any way to end all active sessions, period. I actually advised my client to call Microsoft and tell them that he changed password multiple times and enacted 2FA and both his Outlook 2010 and the hacker's Active Exchange access have not been interrupted. Anybody have any idea what else we can do here?
