What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If a phishing attack exposed a work mailbox, treat it as an identity incident—not just a bad password. Move coordination to a trusted channel, isolate the affected account, scan the device, revoke sessions and tokens, remove hidden persistence, investigate what was accessed or sent, warn affected contacts, and then re-enroll phishing-resistant multifactor authentication. A password change by itself does not remove an attacker who already has a live session, stolen token, forwarding rule, OAuth consent, or added authentication method.
What to do in the first 15 minutes
1. Stop using the suspected mailbox for coordination
Call your IT or security team, use a known-good personal or corporate phone, or use an unaffected collaboration account. Do not send the new password, recovery codes, or incident details through the compromised mailbox; an intruder may be reading and altering messages in real time.
As an Amazon Associate I earn from qualifying purchases.
2. Use a trusted device, and check the endpoint before changing credentials
Perform recovery from a device that the organization trusts. If the computer or phone used to open the phishing link may contain malware, disconnect it from business networks as your incident-response policy requires. Run a current full antivirus scan before changing or resetting the password. Microsoft Support specifically instructs users to complete a full scan first. If responders believe malware or token theft is possible, reimage the endpoint rather than relying on a clean scan; otherwise, newly issued credentials or sessions could be stolen again.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 113. Contain the identity
For Microsoft 365, an administrator should disable the affected user while the investigation is underway. Microsoft’s compromised-account guidance says disabling the account is preferred and highly recommended until the investigation is complete. If immediate disabling is unavailable, have a trusted administrator reset the password through the normal administrative path. Never email the replacement password.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Invalidate existing access
Reset the password and revoke active sign-in sessions and refresh tokens. Rotate any other secrets that may have been exposed, such as application passwords, API keys, service-account credentials, or shared mailbox passwords. A password reset changes future authentication; revoking sessions and tokens removes access that was already granted.
Remove every way the attacker can come back
Attackers often establish persistence before they send a fraudulent message. Review each item from an administrator account and remove anything the user and security team cannot explain.
Authentication methods and MFA devices
- List every registered authenticator, phone number, security key, passkey, and recovery method.
- Remove devices and methods that the employee does not recognize, then re-enroll only verified devices.
- Check whether a new method was added shortly before or after the phishing event; that timing is a strong indicator of persistence.
OAuth applications and delegated consent
Review the user’s consented applications and enterprise applications with access to mail, files, contacts, or calendars. Revoke unfamiliar grants and investigate applications that received broad permissions. An attacker may continue reading mail through an approved token even after the mailbox password has changed.
Forwarding, automatic replies, and inbox rules
- Inspect mailbox forwarding at both the user and organization level. Remove external addresses that were not explicitly approved.
- Review automatic replies for fraud instructions or messages that reveal the employee’s absence.
- Examine all inbox rules, including hidden rules, for actions that delete, move, mark as read, or forward messages. Remove rules created during the compromise window.
Delegates, roles, and group membership
Check mailbox delegates, send-as and send-on-behalf permissions, directory roles, administrative assignments, and security-group membership. Remove unauthorized additions and record the previous state before making changes so investigators can document what happened.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Investigate what happened and what was exposed
Set a precise compromise window
Use the time the user clicked the link, entered credentials, approved an MFA prompt, or noticed suspicious activity as the starting point. Search backward far enough to capture the first sign-in and forward until all sessions, tokens, and persistence have been removed. If the click time is unknown, use the earliest unusual sign-in, rule change, consent grant, or sent message as the provisional start and label it as uncertain.
Review sign-in and audit logs
Examine sign-in logs for unfamiliar locations, devices, browsers, IP addresses, impossible travel, repeated MFA prompts, and successful access after the password reset. Audit logs should show changes to authentication methods, applications, rules, forwarding, delegates, roles, and groups. Export relevant records according to your retention policy before they age out.
Trace messages and mailbox activity
Use message trace and inspect Sent Items, Deleted Items, Drafts, and any recoverable-deletion area. Search for messages sent to customers, suppliers, payroll, executives, or financial institutions. Look for altered reply-to addresses, requests to change bank details, fake invoices, gift-card requests, and instructions to bypass normal approval. Check whether the attacker deleted replies or moved evidence into obscure folders.
Assess data exposure
Determine which conversations, attachments, contacts, calendars, and shared resources were readable. Identify credentials, personal data, contracts, pricing, payment information, or regulated records in the accessed mail. Your privacy, legal, and contractual obligations depend on the data and jurisdictions involved; preserve evidence and involve the appropriate specialists rather than making an unsupported claim that no data was exposed.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Notify people and report fraud quickly
Warn internal and external recipients
From a trusted account, tell employees not to trust recent payment, password, or document-sharing requests from the compromised address. Contact customers and suppliers who received suspicious messages, explain that the mailbox was compromised, and provide a verified phone number or portal for confirming instructions. Ask recipients not to open attachments, click links, change payment details, or reply to the original thread.
Protect payments and bank transfers
If the incident involved a wire, payroll change, invoice, gift card, or other payment request, contact the financial institution immediately through a known telephone number. Ask whether a transfer can be recalled or held and preserve transaction records. Time matters more than waiting for the email investigation to finish.
Report business email compromise
Report payment-related business email compromise to the FBI’s Internet Crime Complaint Center (IC3), and follow your organization’s local reporting, insurance, contractual, and regulatory requirements. Include dates, headers, domains, transaction details, and copies of fraudulent messages where permitted; do not alter the originals.
Rebuild the account securely
Re-enroll phishing-resistant MFA
After the endpoint and identity are clean, enroll trusted multifactor authentication again. Microsoft identifies FIDO2 security keys, passkeys, and Windows Hello for Business as phishing-resistant options. CISA says businesses should aim to use a phishing-resistant MFA method. Choose the method your identity provider supports and your help desk can recover safely, then register a second approved method under documented policy so a lost authenticator does not become an emergency bypass.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Apply least privilege and session controls
Return the user only to the roles, groups, delegates, and applications required for the job. Remove temporary administrator access used during recovery. Use the organization’s sign-in and session policies to require reauthentication after a high-risk event, and monitor for new tokens or authentication methods after the account is re-enabled.
Protect shared and connected accounts
The compromised mailbox may have contained credentials or reset links for other services. Identify accounts that used the same password, shared recovery address, or mailbox-based approval and rotate them through trusted administrative channels. Review shared mailboxes, distribution lists, file stores, CRM integrations, and automated workflows for unauthorized access.
How to verify the attacker is really out
Do not close the incident because the user can log in normally. Verification should produce evidence from several independent checks.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- The affected account is enabled only after the endpoint scan or reimage and identity review are complete.
- Password reset, session revocation, and refresh-token revocation have completed successfully.
- Every MFA method, recovery option, OAuth grant, forwarding address, automatic reply, inbox rule, delegate, role, and group change is known and approved.
- New sign-ins after remediation come only from expected users, devices, and locations.
- Message trace, Sent Items, Deleted Items, and audit logs show no continuing fraudulent activity.
- Recipients, finance staff, legal or privacy teams, and incident responders have documented their follow-up actions.
- A short monitoring period has produced no new suspicious sign-ins, token use, rule changes, or outbound messages.
Choosing recovery controls for the next incident
Recovery controls protect different parts of the environment. Compare them against the organization’s identity provider, help-desk process, logging, and endpoint controls rather than choosing solely for convenience.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
| Control | Phishing resistance | Administrator management | Lost-authenticator recovery | What it protects |
|---|---|---|---|---|
| Password reset alone | Does not remove stolen sessions, tokens, rules, or consents | Available in every directory, but requires secure administrator procedures | Simple to repeat, yet vulnerable if the endpoint or recovery channel is compromised | Only the password credential |
| FIDO2 security key | Phishing-resistant | Requires enrollment, inventory, replacement, and policy support | Requires a second approved key or documented recovery process | The sign-in factor and, with policy enforcement, the wider identity |
| Passkey | Phishing-resistant when implemented by the identity provider | Manageability depends on the provider and device ecosystem | Requires an approved backup or account-recovery path | The sign-in factor; endpoint security remains separate |
| Windows Hello for Business | Phishing-resistant | Works best when centrally enrolled and governed on managed devices | Requires a replacement device or administrative recovery procedure | The user identity on the enrolled device |
No authenticator protects a mailbox that still has an active attacker session or a malicious forwarding rule. Pair MFA with token revocation, mailbox auditing, endpoint protection, and least-privilege administration.
Common recovery mistakes and their fixes
Changing the password on the infected computer
Why it fails: malware or an infostealer can capture the new secret immediately. Fix: use a trusted device, complete a full scan first, and reimage when responders suspect malware or token theft.
Resetting the password but leaving sessions active
Why it fails: an attacker may continue using an existing session or refresh token. Fix: revoke sessions and refresh tokens, then monitor sign-ins after re-enabling the account.
Recommended Free Tools
Deleting one visible inbox rule
Why it fails: hidden rules, forwarding, automatic replies, or delegate permissions can continue to expose mail. Fix: review every persistence location through administrative tools and compare changes with audit logs.
Assuming MFA means the account is safe
Why it fails: an attacker may have added a method, stolen a token, obtained OAuth consent, or tricked the user into approving a prompt. Fix: remove unrecognized methods and grants, revoke tokens, and re-enroll a phishing-resistant method.
Failing to warn recipients
Why it fails: customers and suppliers may act on a fraudulent message after the account has been restored. Fix: notify them from a trusted channel and provide an independent way to verify payment or account-change requests.
Ending the investigation when the mailbox looks normal
Why it fails: sent and deleted messages may not show the full scope of access, and attackers can remain quiet after establishing persistence. Fix: preserve logs, trace the complete compromise window, review connected services, and document a monitoring period with no new indicators.
Quick Recap
A practical incident handoff checklist
- Record who discovered the phishing event, when it occurred, and which account and devices were involved.
- Assign an incident owner and a separate administrator to perform containment and credential changes through a trusted channel.
- Preserve relevant messages, headers, URLs, sign-in records, audit events, and transaction information.
- Track each remediation action: account disablement, password reset, token revocation, method removal, rule cleanup, notification, and re-enrollment.
- Obtain confirmation from finance, legal or privacy, communications, and affected business owners before closing the incident.
- Update the phishing playbook with the actual detection gaps and require phishing-resistant MFA where the organization’s systems support it.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
