An account is being taken over

What happened

Several signs came together: a sign-in from a new country followed by a new 2-step method, a mail rule, mailbox access or mass sharing. This is how attackers secure a stolen account before they use it for fraud.

How serious

Critical: act within the hour.

Steps: Microsoft 365

If it wasn't them: block sign-in. Microsoft 365 admin center → Users → Active users → the person → Block sign-in.
Open the page: admin.microsoft.com/#/users
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Sign them out everywhere: Microsoft Entra admin center → Users → the person → Revoke sessions. This also logs out an attacker who copied their session.
Open the page: entra.microsoft.com
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Reset their password: Microsoft 365 admin center → Users → Active users → the person → Reset password. Give the new one by phone or in person.
Open the page: admin.microsoft.com/#/users
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Check their 2-step methods: Microsoft Entra admin center → Users → the person → Authentication methods. Delete any phone or app they don't recognise.
Open the page: entra.microsoft.com
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Check their inbox rules: sign in as them (or sit with them) at outlook.office.com → Settings → Mail → Rules. Delete rules that forward, delete or move mail they didn't create.
Open the page: outlook.office.com/mail/options/mail/rules
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Check who can open the mailbox: Exchange admin center → Mailboxes → the mailbox → Delegation. Remove Read and manage, Send as or Send on behalf for anyone who shouldn't have it.
Open the page: admin.exchange.microsoft.com/#/mailboxes
Type the address yourself or use your bookmark: never follow a link in an unexpected email.

Steps: Google Workspace

If it wasn't them: Google Admin console → Directory → Users → the person → Suspend user (or reset the password, next step).
Open the page: admin.google.com/ac/users
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Sign them out everywhere: user page → Security → Sign-in cookies → Reset. This also ends a session an attacker copied.
Open the page: admin.google.com/ac/users
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Reset their password: Google Admin console → Directory → Users → the person → Reset password. Give the new one by phone or in person.
Open the page: admin.google.com/ac/users
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Check their 2-step settings: user page → Security → 2-step verification and Recovery information. Remove phones or keys they don't recognise.
Open the page: admin.google.com/ac/users
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Check forwarding and filters in their Gmail: Settings → See all settings → Forwarding and POP/IMAP, and Filters and blocked addresses. Delete what they didn't set up.
Open the page: mail.google.com/mail/u/0/#settings/fwdandpop
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Check Gmail delegates: in their Gmail → Settings → See all settings → Accounts → Grant access to your account. Remove anyone who shouldn't read their mail.
Open the page: mail.google.com/mail/u/0/#settings/accounts
Type the address yourself or use your bookmark: never follow a link in an unexpected email.

How to check it’s fixed

Fixed when the person confirms the activity, or when the password is new, all sessions are signed out and no unknown method, rule or app is left. Ojava raises no new alert for them.

When to call your IT provider

Call your IT provider now if the person didn't do this, or if you are unsure.