Google Workspace and Microsoft 365 account takeover
Your work email is the key to almost everything: booking platforms, the bank, social media. If it's broken into, attackers can quietly read and forward your messages.
Suspicious forwarding rule
- Account
- [email protected]
- New rule
- Forward email containing “invoice” or “transfer”Needs checking
- Destination
- An address outside the companyNeeds checking
- Just before
- Sign-in from a new device and country
Illustration. Names, domains and data shown here are fictitious.
An attacker inside your inbox
Attackers take over a work email account, usually through a fake sign-in page. Newer techniques steal not just the password but the active sign-in session. With that session they can get in without passing the two-step verification code.
Once in, they often create hidden rules: emails about invoices are forwarded outside or moved to a folder nobody opens. The account owner doesn't notice, while the attacker waits for the right moment to send a fake invoice.
What it means for your business
Fraud from your real account
Fake invoices go out from your own address, so guests and partners don't suspect a thing.
Other accounts open up
Password resets for booking platforms, the bank and social media usually go to this email.
Quiet data leaks
Guest conversations, contracts and documents can be read for weeks without anyone knowing.
Warning signs to look out for
Share this list with your front office, reservations and finance staff. When in doubt, ask first.
- Sign-in alerts from a device or country you don't recognise.
- Replies from guests or partners go missing, or land in a folder you rarely open.
- Forwarding rules or filters you never created.
- Colleagues or partners say they've had strange emails from your address.
- You're asked to sign in again after clicking a link, though you're already signed in.
- A new third-party app has been granted access to your account.
How SiberWisata helps
We protect email from two sides: what arrives in the inbox, and what happens inside the account.
Cloud Email Protection
Cloud Email Protection watches for suspicious sign-ins, new forwarding rules and unusual app permissions in Google Workspace or Microsoft 365. If an account is confirmed compromised, we lock it, end the attacker's sessions and remove the rules they created.
See this service →Managed Detection & Response (MDR)
MDR watches the devices where email is opened, because sign-in sessions are often stolen from an infected PC.
See this service →Monitoring is continuous. Analyst hours and response times are agreed per plan and written into the contract.
Attacker session ended
The finance@ account signed in from two countries within 10 minutes. All sessions ended and the forwarding rule removed.
Illustration. Names, domains and data shown here are fictitious.
How it works
Accounts are watched
Sign-ins, inbox rules and app permissions are monitored continuously.
Odd activity is checked
An analyst confirms whether it's your staff or an attacker.
The account is recovered
Sessions ended, password changed, rules removed, then we help check whether any invoices went out.
Related threats
All threats →Payment fraud
Fake “our bank account has changed” messages that divert payments from guests, agents or suppliers.
Read more →Staff phishing
Fake emails, messages and QR codes aimed at front office, reservations and finance.
Read more →Domain & DNS
Expired or hijacked domains, changed DNS, and others sending email in your name.
Read more →
Not sure your organisation is safe?
Tell us about your organisation. We look at your situation from the outside and explain what we find in plain language, without obligation.