Reclaim the inbox and clear what they planted

    While the attacker has access, anything you do is visible — lock it down before notifying anyone.

    JDCS
    By Jordan Dickson · Reviewed by CSG Security Engineers

    Updated June 2026 · 1 min read

    Order matters: kill sessions and reset password before warning anyone. If you email contacts while the attacker still has access, you're warning the attacker, not your contacts.

    Common attacker artefacts to remove

      • Forwarding rule named like 'Inbox' or 'Junk' (sounds innocuous)
      • Filter that auto-deletes replies from your bank or accountant
      • OAuth grants to unknown 'mail' or 'productivity' apps
      • Delegated mailbox permissions you didn't set

    Was this guide helpful?

    Know someone who needs this? Send them the guide.

    JD

    Written by

    Jordan Dickson

    Founder, CyberSecurityGuides

    Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.

    Reviewed by CSG Security Engineers

    More from Communications Security

    No image

    Verify the real person is safe

    Before anything else, confirm that your loved one is actually fine.

    No image

    Set up a family safe-word and warn the household

    A shared secret beats AI — set it up immediately so this can't happen again.

    No image

    Don't pay, don't reply, don't delete

    Capture the threat as evidence and isolate the conversation — don't engage further.