Stop an email worm before your contacts become targets

An email worm is a self-propagating malware strain that harvests email contacts and sends deceptive messages to everyone it can reach. These mass-mailing worms commonly carry phishing links disguised as invoices, shared files, parcel updates or password alerts. Each trusted recipient becomes another possible route, so quick containment matters.

Australian small businesses in Sydney, Melbourne and regional offices often depend on Microsoft 365 or Google Workspace, with staff checking Outlook on desktop and mobile. A compromised mailbox may send convincing messages that imitate a local supplier or request an A$1,600 transfer, while shared-mailbox permissions can conceal an auto-forwarding rule.

The Privacy Act 1988 and OAIC guidance call for a careful check when personal information may have been accessed. Small businesses and households can report incidents to the ACSC, ReportCyber or Scamwatch, but reporting does not replace account recovery and malware removal.

Know how the worm travels

Email worms can spread from an infected endpoint, a stolen webmail password or an abusive mail add-in. Some harvest the Outlook address book or uploaded contact files; others use the infected device to send messages through the user’s account. Understanding common email worms makes their behaviour easier to recognise.

Not every malicious email proves the computer is infected. If contacts receive messages while the Sent folder contains nothing unusual, the webmail account or an OAuth application may be compromised. If the device created the messages, an email client add-in, script or other persistence mechanism is likely involved.

Treat these cases separately. Changing a password will not delete malware, while removing files will not revoke an attacker who still controls the mailbox. Evidence from sent items, inbox rules, delegated access and installed applications determines the correct cleanup path.

Identify signs and contain the spread

Warning signs include unexpected sent mail, drafts that vanish, newly created inbox rules, replies from strangers claiming they received a suspicious link, and sudden contact-list changes. Inspect message headers and destinations, but do not open attachments or test suspicious URLs in a normal browser.

On an infected Windows or Mac, disconnect the network, stop Outlook or the browser, and leave the device powered on unless IT or a qualified examiner directs otherwise. Disconnecting limits further delivery while preserving volatile evidence. Corporate users should contact their security team before changing settings or reinstalling software.

Use a separate clean device to notify colleagues and affected contacts through a known channel. Give a short warning, state what was sent, ask recipients not to click or open attachments, and explain that they should delete the message rather than forward it. This reduces secondary infections among their contacts.

If clicking the link altered Chrome, Firefox or Edge with redirects, unknown extensions or changed search settings, isolate the device and use browser cleanup steps to remove those changes. Reset only the compromised account credentials from the clean device.

Compare likely causes and responses

A rapid triage distinguishes account abuse from endpoint infection without assuming every symptom has the same cause.

What you observe	Likely cause	First response
Contacts receive phishing messages, but Sent stays empty	Stolen webmail credentials or rogue OAuth consent	Reset the password and revoke sessions and app permissions
Sent items contain new invoices or phishing messages	Endpoint infection, malicious add-in or script	Isolate the device and begin malware cleanup
Mail is silently forwarded or rules keep changing	An attacker-created inbox rule	Review rules, delegates and mailbox audit logs
Searches redirect and advertisements appear on every site	Browser hijacker or unwanted extension	Remove extensions and restore browser settings
Fans run constantly and performance collapses	An additional unwanted payload	Scan persistence mechanisms and investigate system activity

Use timestamps to connect the first malicious message with newly installed software, browser extensions, inbox rules or sign-in events. Mailbox audit logs may show the source IP address, while endpoint logs can reveal whether the device initiated the outbound campaign. Preserve relevant records before deleting anything.

Remove the infection and restore control

Begin account recovery from a clean device. Change the affected email password, revoke active sessions, enable multi-factor authentication, remove forwarding rules and inspect recovery email addresses, phone numbers, delegates and OAuth permissions. Also change any password reused elsewhere, prioritising banking, payroll and cloud-storage accounts.

On the infected device, run a reputable full security scan and an offline scan if available. Remove malicious Outlook add-ins, browser extensions, recently installed applications and suspicious startup entries. Check scheduled tasks, services and other persistence mechanisms. Windows Safe Mode can assist some cleanup procedures, but it should not be used to delete unfamiliar system files or commands copied from an unverified forum.

If the scan also identifies unauthorised cryptocurrency mining, the cryptomining cleanup guide explains how miners conceal themselves and how to remove their scheduled tasks and startup entries. Once the device is clean, restore affected files or applications from known-good backups rather than reinstalling everything from the infected system.

Monitor the mailbox for further suspicious activity after cleanup. A message timestamped before the password reset does not prove safety, because delayed or queued malware may remain. Keep the device offline until a second scan confirms that the worm, its persistence mechanisms and any additional payloads have been removed.

Break the cycle with lasting safeguards

Removal is effective only when the mailbox and device can no longer be used to spread the campaign. The same controls also protect against future phishing links, malicious add-ins and browser-based payloads.

For an Australian organisation, account recovery should be paired with clear procedures for warning customers, suppliers and staff whose addresses appeared in the contact list. Records of affected accounts and messages make it easier to meet privacy obligations and coordinate with an IT provider.

• Restrict mailbox permissions and require phishing-resistant multi-factor authentication, removing legacy authentication and unused OAuth grants.
• Review inbox rules, forwarding settings, delegates and application access regularly and after every suspicious alert.
• Patch the operating system, browser and email client promptly, allowing only approved extensions and removing unnecessary add-ins.
• Maintain offline or immutable backups, rehearse restoration and avoid restoring contact files or messages onto a compromised device.
• Assess notification duties under the Privacy Act and OAIC guidance, then report serious incidents to the ACSC or ReportCyber and consumer scams to Scamwatch.

For households, changing the affected email password, enabling multi-factor authentication and checking every account linked to the infected device can prevent the worm from returning through another mail profile.