Malicious Email Forwarding
A client recently contacted me that she noticed all her contacts were gone in her email. She suspected someone had gained access to her @yahoo.com account. I'm not sure why email hackers always delete address books, but it's the second case of it I've encountered so far.
Furthermore, this person also noticed that they hadn't been receiving email for about 10 days. She'd been on vacation, so she at first thought maybe people just magically knew she was on vacation and stopped emailing her (we can dream, right?) She didn't have an auto-responder on either, so this seemed even more fishy.
After we changed her password using her recovery phone number (make sure you have one set up!) and gained access to her account, I noticed that, sure enough, all of her more than 2,000 contacts had been deleted. They weren't in the deleted contacts section, so I filled out this handy little form that Yahoo provides to get them back. Keep in mind this process will wipe the current address book, but since she didn't have any in the first place, that wasn't much of an issue. Within about 3 hours someone from Yahoo contacted me to let me know they'd been restored.
From there, I snooped around a bit more, sending and receiving test messages. I noticed that messages I sent to the compromised account were not arriving in the inbox. In addition to that, messages sent from the compromised account were signed with a different account, "[email protected]." For the past 10 days, all email that this person received was being forwarded to the hacker. The hacker could've in theory impersonated her and done whatever they wanted.
I'm familiar with Gmail's account settings, so I know that email can be forwarded to another address as well as all replies forwarded to it. This seems to be what the hacker had done, in addition to adding that address as a recovery address to the account. After removing the account, I also turned off email forwarding and removed the reply-to address. Here's a quick rundown from Yahoo of things to look for after someone has hacked your account.
After that, we were pretty much back to how we were. Unfortunately, the 10 days worth of unreceived email was likely out of my reach. I went down a bit of a rabbit hole over at outlook.com trying to find out or gain access to the account, to no avail. I've contacted Yahoo customer support to see if I can get those forwarded messages, we'll see what they have to say.
I told my client she should probably just send out a quick email to those that she communicates with regularly explaining the situation, that she did not see any communication in the past 10 days and to please re-send any important email.
In the future, I told her it's good to use things like 2-step verification or a password manager like 1password to create strong, unique passwords for each account. Various companies have data breaches all the time and it's likely that some of your accounts share the same credentials.
