Angreifer liest weiter mit: Gehacktes Mailkonto: Ein Passwortwechsel ist nicht genug

When hackers gain access to a user's email account, family members, friends, or colleagues may reach out due to unusual emails requesting money that appear to originate from the user themselves. Upon noticing similar suspicious messages, extreme vigilance is required as the hackers likely have access to the user's inbox. Most users would likely react appropriately by changing their password and having their antivirus software perform a full scan.

However, few may realize that changing the password is merely the first step, as Mike Kuketz, an IT security researcher, explains in his blog. According to Kuketz, users should also check the following five points in their account settings: automatic forwarding, filter rules, active sessions, connected applications and services, and saved recovery options.

Automatic forwarding is a major concern, as if hackers have enabled it, they can effortlessly intercept all incoming emails. They do not even need access to the user's account anymore, as they can simply forward the messages. Filter rules could also be in place, moving security warnings or authentication-related emails containing terms like "security warning," "login," and "confirmation code" into the user's archive folder without their knowledge.

Active sessions should be terminated for safety purposes, and connected applications and services should be reviewed for any unauthorized links. Additionally, hidden recovery options containing email addresses not set by the user should be replaced with their own addresses.

It is crucial to verify if other accounts might have been affected alongside the email account. The Federal Office for Information Security (BSI) and the Police's Criminal Prevention of the States and the Federal Government (ProPK) have created a checklist, available as a PDF, detailing these steps and offering further advice for preventing hacked accounts.

This includes using strong passwords combined with two-factor authentication or the passkey method, which offers a secure, passwordless login process handled behind the scenes through cryptographic keys.