If you discovered somebody had gotten into one of your email accounts, what would you do first?
I’m guessing changing the password would be pretty high on the list.
And you’d be right to do it.
But there’s a new type of attack that shows why changing a password isn’t always enough to get an attacker back out.
It starts with phishing.
Someone receives an email and ends up on a fake login page for a service they recognize. They enter their details, believing they’re signing into their account as normal.
But behind the scenes, those login details are being passed straight to a cybercriminal.
So far, this is a fairly familiar phishing attack.
What’s different is what happens next…
While the victim sees a processing screen for a few seconds, the attacker can attempt to add a passkey to the account.
You may already have heard of passkeys. They’re an alternative to passwords and let you sign in using something like your fingerprint, face or device PIN.
They’re generally a very good security improvement. The problem here is that the criminal is trying to register their own passkey on an account they’ve broken into.
If they’re successful, you’ve potentially got an unwelcome guest with their own way back in.
That’s why changing your password might not solve the problem.
You could discover the attack, reset the password and sign out every device connected to the account. You might reasonably think you’ve secured everything. But if the attacker has managed to add another way of signing in, there’s more work to do.
And this may be an eye opener to what recovering from a cyberattack really involves.
When we help someone deal with a compromised account, we’re interested in more than the password. We want to know what the attacker did while they had access.
Did they add a new way of signing in?
Did they change the recovery details?
Did they connect another application to the account?
With email in particular, there are other places that need checking too. An attacker could create rules that automatically forward certain messages elsewhere, for example. That could allow them to continue seeing useful information without needing to sit inside the inbox.
Imagine the possibilities if they’re watching emails about invoices, payments or conversations with customers and suppliers. They could also make changes that are easy to overlook when you’re concentrating on getting control of the account back.
This is why I’d always recommend getting your IT support partner involved if you think a business account has been compromised.
Changing the password is an important first move, yes, but somebody should also check the account properly to understand what’s happened and make sure the attacker hasn’t left themselves another route back in.
That means reviewing the ways someone can sign in, checking for unfamiliar devices and applications, looking at email forwarding and rules, and making sure recovery details haven’t been changed.
You also want to understand how the attacker gained access in the first place.
If somebody entered their details into a phishing page, for example, there may be an opportunity to help the wider team recognize a similar attack next time.
Cyberattacks keep evolving, and unfortunately that means the way we respond to them has to evolve too. If you ever discover that one of your accounts has been hacked, absolutely change the password.
But don’t assume that’s where the job ends.
If you’re concerned somebody may have accessed one of your business accounts, we can help you work out what’s happened and make sure they’re properly locked out. Get in touch.