Account Takeover Recovery

We confirm which accounts are affected, whether the compromise is limited to one user or has spread across the tenant, and whether an admin account is involved. An attacker who reaches an administrator is a different problem from one stuck in a single mailbox, and triage tells us which we are facing.

We break the attacker’s access immediately: revoke active sessions and tokens, force a password change, and disable the account if needed. Where the compromise is spreading, we move fast to protect the accounts not yet hit. Containment here is the moment control shifts back to you.

Then we remove everything the attacker planted to keep their access: extra authentication methods, malicious OAuth grants, rogue inbox rules, and any new accounts they created. This is the step self-led recoveries usually miss, and it is exactly the step that decides whether the takeover is truly over.

With the account secured, we restore it to a trustworthy state, re-enrol legitimate authentication, and check that no data or configuration was left tampered with. Where mailboxes or files were altered, we help you understand and repair the damage.

Finally we close the weakness that allowed the takeover and strengthen the obvious neighbours, so the same method fails next time. For most tenants that means better conditional access, phishing-resistant authentication, and tighter control over app consents.

Information-stealer malware on a device grabs the browser cookies that represent an already-authenticated session. With that token, an attacker is logged in without ever needing your password or your second factor. This is one of the most common routes we see, and it is why revoking sessions, not just changing passwords, is central to recovery.

Toolkits of the Evilginx type sit between you and the real login page, relaying your password and your one-time code in real time and capturing the resulting session. Basic MFA, especially codes and push prompts, does not stop this. Phishing-resistant methods like passkeys and FIDO2 hardware keys do, which is why we push you toward them in hardening.

If a password was reused from a site that was breached, attackers simply try it against your accounts at scale. When it works and MFA is weak or absent, they are in. This is dull and extremely effective, and it is why password reuse remains one of the biggest practical risks to any organisation.

Sometimes the attacker never steals the password at all. They trick a user into approving an OAuth application that grants ongoing access to mail and files. The consent persists even after a password change, which is why an app-consent audit is a non-negotiable part of the cleanup.

Reading the sign-in and audit logs

Across all of these, the truth is in the logs. In Microsoft environments we work through the Entra sign-in and audit logs and the Unified Audit Log to see where the attacker connected from, what they accessed, and what they changed. Those records tell you the real scope, and they are the evidence you will need if the incident becomes reportable.

Beyond revoking sessions and resetting credentials, we hunt for the tricks attackers use inside a tenant: inbox rules that auto-delete or forward mail to hide their activity, mailbox delegation quietly added, enterprise app registrations granting standing access, and new global admin accounts. Each is a way back in that survives a password reset, and each has to be found and removed.

We use message trace and the audit logs to understand whether mail was read, exported or forwarded, and whether the attacker used the mailbox to launch further attacks on your contacts. A hijacked mailbox is often the launchpad for invoice fraud against your suppliers, so this scoping protects more than just you.

Under Article 33 of the GDPR, if a compromise is likely to result in a risk to people’s rights, you must notify your supervisory authority within 72 hours of becoming aware. An attacker sitting in a mailbox full of personal data, or inside a system holding customer records, can meet that threshold. Our scoping of exactly what was accessed gives your legal counsel the facts they need to make the call.

Where your customers’ accounts were taken over, the people affected are your users, and Article 34 may require you to inform them directly without undue delay. We help you understand the scale of the compromise so those notifications are accurate rather than alarmist or evasive.

Sign-in and audit logs age out, sometimes within weeks. Preserving them early is part of both a clean investigation and a defensible position with your regulator, so we capture what matters before it rolls off.