On Sat, 16 Sep 2023 15:41:36 +0000, David wrote:
We have just discovered that a friend's Hotmail account has been
compromised.
Not sure how because they are normally very cautious.
The interesting timing is because they have just bought a new laptop and
I helped with the configuration, and 2FA wasn't working because the
account had a (correct) phone number associated with it but this failed
to ring and supply the 2FA prompt.
[I suspect that M$ was assuming a mobile phone and tried to send a text
to a land line.].
Anyway we decided to change the 2FA setting to a Gmail account.
Because of the 2FA failure a wait of 30 days was put on any further
account activity.
Recently (about a week ago) another email was received saying the
waiting period was over.
Today phishing emails are going out from that account.
Correlation and causation, of course, but it does make me wonder.
Is this ringing bells with anyone?
Update: I found a phishing email claiming to be from Microsoft dated the
day the compromise happened.
One of those "timing" this where an email from Microsoft was expected.
No admission from my friend, but circumstantial evidence looks pretty
solid.
Microsoft provide a security log for the account which showed a successful
log in from Nigeria at the expected date, then further successful log ins
from other devices around the world.
I reset the password using the newly activate 2FA with a Gmail address as
the second channel.
I then had a head scratcher because emails were going out but not being received.
Being out of practice it took me a while and some Internet searching (Bing
not Google) to remind myself about redirects.
I looked at the configuration page for the Hotmail account using Outlook
web and there was no redirect showing.
However when I set up another redirect it all sprang back to life.
I cleared the redirect and all still seems to be working.
In this case, no real harm done as the subsequent phishing of the contacts
for Amazon gift vouchers for someone apparently in Canada were not
convincing.
Also fortunately my friend doesn't shop or bank on line.
Think Luddite.
So the email address could not be used to reset credentials on web sites
which could then be used to buy stuff.
All in all a salutary tale, and a reminder to be double wary if you are expecting an email.
Cheers
Dave R
--
AMD FX-6300 in GA-990X-Gaming SLI-CF running Windows 10 x64
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)