Book a call

What we do

Book a call

Defend · Incident response

Phishing

One convincing email, one click, and an attacker is signed in as a colleague, sending mail in your name. This is the response, as it ran in the case that set our standard.

Book a call Back to Incident response

The attacker doesn’t break in. They sign in.

A phishing mail doesn’t install anything clever. It gets a password, and with it the attacker signs in as a colleague: reads the mailbox, sets up rules that hide their traces, forwards what’s useful, and sends a mass mailing to every contact so the next firm falls for it too. By the time anyone notices, the account has been theirs for a while, and the mails that went out carry your name. So the response is about the account and everything it reached: lock it, throw the attacker out of every session, remove what they set up, find out what they opened and sent, and rule out that they left another way in.

The runbook

What we do, in this order.

The sequence is the same as for every incident: contain, check, clean up, tell you first, write it down. This is what each step means when the incident is a taken-over account.

  • Lock the account, revoke every session

    The password is reset and every session the attacker holds is revoked, in the whole tenant where needed, so nothing more goes out in your name and a stolen token stops working.

  • Secure the evidence first

    Before anything is tidied, the mail-flow and message-trace data, the sign-in logs and the account’s activity are secured and analysed: when they got in, from where, and what they did.

  • Remove what they set up

    Inbox rules that hid their traces, forwardings to outside addresses, app permissions and sessions: everything the attacker added comes out, and the account is hardened before it goes back to its owner.

  • Follow the chain

    Which accounts the phishing mail reached, which fell for it, what was accessed, what was sent and to whom. The affected people inside the firm are mapped; the recipients outside are narrowed down.

  • Check everything around it

    Servers and the systems around them, the network, the devices the account signed in from: the other ways in are checked and ruled out, so the attacker isn’t still inside somewhere else.

  • Give your data protection officer the facts

    For the decision whether to report it: which data, which people, when, and the timeline, in the form the notification and the impact assessment need. The legal assessment stays with you.

On record

In your evidence file.

  • The timeline: the first call, the account locked, every session revoked, the last check
  • Which accounts were reached, what was accessed and what was sent to whom
  • What was removed: rules, forwardings, sessions, permissions
  • The facts handed to your data protection officer, and when
  • A short technical report, a version for your firm and a summary for your leadership

What usually goes wrong without it.

  • Only the password is changed

    The password is reset and everyone relaxes. The attacker’s sessions stay valid, their forwarding rule stays in place, and the mailbox keeps leaking for weeks.

  • The second account nobody checked

    The mass mailing came from one account, so one account is cleaned. The phishing mail reached six others, and one of them had already fallen for it.

  • The report written from memory

    A week later the data protection officer asks what left the firm and when. The logs have rolled over, the mailbox was tidied, and the answer is a guess.

Also under Incident response

Questions we get

Is this what you actually did for a client?

Yes. A member of staff at a real-estate services firm fell for a phishing email; the attack reached seven accounts and the attacker sent a mass mailing of 2,500 mails. Two of our engineers worked in parallel from the first day. On the sixth day every session in the tenant was revoked; on the seventh the other ways in were ruled out and the reply to the data protection officer was ready. That response became our standard for every client.

Do we have to tell our clients that mails went out in our name?

That’s your decision, and the legal assessment stays with you. We give you the facts to make it: which recipients got what, when, and whether anything of theirs was accessed. Then we help you tell them in words that are accurate, and your evidence file keeps the record.

Can you stop phishing from happening at all?

No one can, and we don’t say we can. The layers before this page, email security, a second factor for everyone and conditional access, stop most attempts; this page is for the one that gets through. What we can promise is that the sequence is the same every time, and that it ends in the record.

Start

What happens at your firm when someone clicks?

In a first call we go through who your people would call, who could lock an account and revoke its sessions, and what your evidence file would show afterwards.

Book a call Test us for three months