When a client’s mailbox is already sending junk, password and MFA are not the finish line. Your client changed the password. They turned on MFA. They still want to know who got the fake invoice.
That sequence is the common small-business story after a Microsoft 365 or Google Workspace mailbox is taken over. The password change stops the next password login. It does not kill the session the attacker already has, the inbox rule they hid, or the delegate they added on the way out.
Here is the cleanup I walk clients through, in order. None of it requires buying a product. It does require an admin who can open Entra (or Google Admin), Exchange, and a message trace.
1. Kill the session, not just the password
In Microsoft Entra, open the affected user and revoke sessions. If the investigation is still messy, block sign-in until the review is done.
An attacker who already had a token can keep reading mail after the password change. MFA methods they registered (a phone, an Authenticator, a FIDO key the client does not recognize) should be deleted at the same time. User-consented apps should be revoked unless the client can name why that app is there.
2. Hidden inbox rules are the quiet theft
Attackers rarely leave a rule named “Forward to hacker.” They name it something boring, they hide it, and they dump matching mail into RSS Subscriptions, Notes, or Junk so the owner never sees the thread.
In Exchange Online PowerShell:
Get-InboxRule -Mailbox user@clientdomain.com -IncludeHidden | Format-List Name,Enabled,RedirectTo,ForwardTo,ForwardAsAttachmentTo,MoveToFolder,DeleteMessage
Remove anything that forwards, redirects, deletes, or files mail into RSS / Notes / Junk unless the client can explain it.
SMTP forwarding is a separate setting. Inbox rules are not enough:
Get-Mailbox user@clientdomain.com | Format-List ForwardingSmtpAddress,ForwardingAddress,DeliverToMailboxAndForward
Clear unexpected forwards.
3. Delegation and Send As
Mailbox takeover is often used to stay after the password reset. Check who has Full Access, Send As, and Send on Behalf on the mailbox. An extra delegate is as useful to an attacker as a forward.
4. Who received the junk
In Microsoft Defender or Exchange admin, run a message trace: that mailbox, outbound, the day of the blast. Export CSV. That file is the recipient list for the “please ignore the invoice” calls.
Also save Entra sign-in logs, interactive and non-interactive, for the 48 hours around the blast. IPs and unusual countries matter later for the insurance notice and for whether other mailboxes were touched.
5. What this is not
This is not a substitute for MFA, EDR, or a cyber policy. Native Microsoft alerts that land in a mailbox nobody opens are not a monitor. If a client tells an underwriter they “monitor mailbox rules,” they should be able to say who looks, how often, and what happens after hours.
For Google Workspace the same ideas apply: revoke sessions, check routing and filters, check OAuth apps, check delegation, pull the admin audit log, and do not stop at a password change.
What to tell the client in the first hour:
- Do not use the compromised laptop to do the cleanup.
- Out-of-band the money movement: call known numbers, not numbers in the email.
- Password, MFA, revoke sessions, hidden rules, SMTP forward, delegates, message trace, sign-in IPs.
- Then watch the tenant. The next grant, forward, or rogue app is how the second wire happens.
If a CPA firm wants a one-page version of this checklist for client files, use the steps above as-is. They are the same steps Microsoft documents for a compromised cloud mailbox. The failure mode is stopping at step one.
ABOUT THE AUTHOR:
Dario Dulovic is based in Omaha and builds InboxGuards, a self-serve alarm that reads Microsoft 365 and Google Workspace audit logs for mailbox-takeover signals. This article is a cleanup checklist, not a product pitch.
Sign in to get access to this free resource, and all of our whitepapers and reports.
Download this content today!
Register Now Already registered? Click here to Log In
Tags: data security, email, email security, Firm Management, phishing, spam
