When someone breaks into a business mailbox, the first reaction is to change the password. That step matters, but it rarely finishes the job: while they were inside, the attacker may have set up other ways to keep reading your email. This article explains where that hidden access sits and how to remove it, with the Microsoft 365 steps our engineers use.
Why a new password is only the first step
After you sign in, your browser or Outlook app holds a session token that says the login has already been approved. Until that token expires or is revoked, it can keep working, and a password change does not always cancel it. Some phishing pages capture the token as well as the password, and malware can steal the cookies a browser has stored. With a valid token, an attacker can skip the sign-in page and the MFA prompt altogether.
A password change also leaves the mailbox settings untouched. Anything the attacker created while inside stays there until someone finds it.
Five ways an attacker can stay in
1. Sessions that are still signed in
A browser or mail app that signed in before the reset may still be connected. Close these first, because someone still inside can undo every other fix.
2. Forwarding and inbox rules
A rule can copy every incoming email to an outside address. More often it is selective, forwarding only messages that mention "invoice", "payment", "bank details" or "password reset", so everything else arrives as normal and nobody notices. Rules can also hide things, moving a supplier's replies or security alerts into a folder nobody opens. Some rules do not appear in Outlook at all, which is why Microsoft recommends that an administrator checks every inbox rule, including hidden ones.
3. Connected apps
When a user accepts an app's consent screen (a process called OAuth), the app can get permission to read mail, send mail or change settings without knowing the password. Attackers build genuine-looking apps for exactly this purpose. A familiar name and logo prove nothing, and a password reset does not always remove the permission.
4. Delegates and mailbox permissions
Exchange Online lets one person work in another's mailbox with Full Access, Send As or Send on Behalf permissions. The delegate signs in with their own account, so resetting the owner's password has no effect on them.
5. Sign-in and recovery methods
An attacker may register their own phone number, authenticator app or passkey on the account, letting them approve their own MFA prompts or reset the password again later.
How to secure a compromised Microsoft 365 mailbox
Most of these settings are only visible to an administrator, so this is a job for your IT team or provider, not the employee. Microsoft's response guide (linked below) has the full process; these are the steps in the order we follow them.
Block sign-in and revoke sessions
In the Microsoft Entra admin centre, block sign-in for the user, then use Revoke sessions to sign out every device and app. Revocation can take a little time to reach every app, so keep the account blocked until the clean-up is finished. If the employee's laptop may have malware, take it off the network for checking.
Reset the password properly
Set a new, unique password and give it to the employee by phone or through your password manager, never by email to the affected mailbox. If the old password was used anywhere else, change it there too. Remove any legacy app passwords: Microsoft notes that these are not revoked by a normal password change.
Remove rules, forwarding and delegates
In the Exchange admin centre, check the mailbox's forwarding and delegation settings, then list every inbox rule, including hidden ones, with Exchange Online PowerShell. Remove anything that neither the employee nor the administrator can explain. Also check the automatic reply, the signature, and whether POP or IMAP access is on without a business reason.
Review apps and authentication methods
In Entra, review the enterprise applications this user has consented to and the permissions each one holds, and remove anything the business does not recognise or use. Then open the user's authentication methods, delete any phone, authenticator or passkey the employee does not recognise, and have them register MFA again on their own device.
Work out what the attacker did
Review the Entra sign-in logs, the audit log in Microsoft Purview and a message trace, starting well before the first warning sign: the break-in may be older than it looks. One login from an unusual country is not proof on its own, since VPNs and mobile networks distort location. In the mailbox, check Sent Items, Deleted Items and Drafts for messages the employee did not write.
Warn the people who may have been targeted
If the account sent false messages, call the recipients on a number you already hold and tell them exactly which messages were not genuine.
If payment details may have been changed
For finance firms in Hong Kong and Singapore, the biggest risk from a compromised mailbox is often what it is used for. This is business email compromise: a convincing message, sent from a real account or slipped into a real conversation, asking a client or your accounts team to pay a "new" bank account.
If money may have gone to a fraudster:
- Call your bank at once. Use a number from its official website or your own records, never one from the email thread. Speed matters.
- In Hong Kong, call the Anti-Scam Helpline on 18222, run by the Police Anti-Deception Coordination Centre, and report the case to the police.
- Check your data protection duties. If personal data was exposed, ask your legal or compliance adviser about notification. Hong Kong and Singapore both have guidance on handling and reporting data breaches, so check the current requirements straight away.
From then on, confirm any change to bank details by phone, on a number you already hold, before anyone pays.
How to make it harder next time
- Block automatic forwarding to outside addresses with the outbound spam filter policy in Microsoft Defender, unless your business has a specific need.
- Limit who can approve apps. In Entra, stop staff granting consent to unknown apps and send requests to an administrator.
- Use stronger MFA. Microsoft Authenticator is the minimum. Passkeys resist fake login pages far better than codes; start with administrators and anyone who handles payments.
- Add Conditional Access policies that require MFA and block sign-ins that break your rules, for example from unmanaged devices.
- Make reporting easy. Staff should report unexpected MFA prompts and sent messages they did not write straight away.
For more everyday habits, see our earlier article on six simple steps to enhance your email security.
Frequently asked questions
Does changing the password sign out every device?
Not reliably. In Microsoft 365, an administrator should block sign-in and use Revoke sessions in the Entra admin centre as a separate step.
Can someone still read my email after the password is changed?
Yes. A forwarding rule, a connected app or a delegate permission can all keep working after a reset. Each needs to be checked and removed.
Should we delete the compromised account?
No. Block sign-in instead while it is investigated. Deleting the account can lose the mailbox contents and records needed to work out what happened.
Is MFA enough on its own?
No. MFA helps stop new sign-ins with a stolen password, but it does not remove sessions, rules, apps or sign-in methods an attacker has already added.
Sources and further reading
- Microsoft: Responding to a compromised email account
- HKCERT: security advice for Hong Kong organisations
- Cyber Security Agency of Singapore
- Office of the Privacy Commissioner for Personal Data, Hong Kong
- Personal Data Protection Commission, Singapore
If you think someone may still have access to a mailbox in your business, or you would like us to review your Microsoft 365 security settings before it happens, talk to our team. Our cybersecurity services and Microsoft 365 services cover both the response and the prevention.
