What to Do After Malware Hijacks Your Email Account

An email account hijacked by malware can quickly become a gateway to other accounts, private messages, financial services, and workplace systems. Attackers may use stolen session cookies, saved passwords, malicious browser extensions, or information-stealing trojans to access the inbox without triggering an obvious warning.

Act quickly, but avoid making changes from a computer that may still be infected. A password entered into compromised Windows or Mac software could be captured again, allowing the intruder to regain access even after you reset the account.

The steps below focus on containment, account recovery, malware removal, and prevention. If the incident involves work systems, regulated information, or suspected financial theft, notify the relevant organization and preserve evidence before deleting suspicious messages or files.

Recognize The Signs Of Account Takeover

Unexpected password-reset emails, unfamiliar login alerts, and messages sent without your knowledge are common indicators. Check the sent folder, deleted items, forwarding rules, mailbox filters, recovery addresses, and active sessions. Attackers often create hidden rules that copy incoming mail or move security notifications away from the main inbox.

Other warning signs include contacts receiving phishing messages from your address, changed email signatures, new app permissions, or an inbox that suddenly marks large numbers of messages as read. A browser redirect or an unfamiliar extension may point to credential-stealing malware rather than a simple stolen password.

Do not click links in suspicious security alerts. Open the provider’s website by typing its address manually or using a trusted mobile application, then review the account from there.

Isolate The Infected Device

Disconnect the suspected computer from Wi-Fi and wired networks if it shows signs of infection. This can interrupt communication with a command-and-control server and reduce the chance that fresh passwords, authentication tokens, or files will be transmitted. Do not reconnect it merely to test whether the problem has disappeared.

Use a separate, trusted device to change the email password. A clean phone or another computer with updated security software is preferable. If you have no safe device, consider using a reputable public or borrowed computer temporarily, while avoiding the storage of passwords and signing out completely afterward.

If adware, pop-ups, browser redirects, or unwanted extensions are present, review this adware removal guidance alongside a full malware scan. Adware is not always responsible for an account takeover, but it can indicate that the browser environment has been altered.

Reclaim And Harden The Mailbox

Change the password to a long, unique passphrase that has never been used elsewhere. Then sign out all active sessions, revoke unknown third-party applications, remove unfamiliar app passwords, and regenerate backup codes. Enable multifactor authentication with an authenticator application or hardware security key when possible.

Review every recovery option carefully. Replace an unknown phone number or backup address, inspect authorized devices, and check whether an attacker added an email-forwarding rule. Some services provide a recent activity report showing IP addresses, locations, browsers, and access times; save screenshots or export records before the data changes.

Use this quick comparison to prioritize the most important account controls:

Account Area	What To Check	Appropriate Response
Password	Reuse, recent changes, weak phrases	Replace it from a clean device
Sessions	Unknown browsers, phones, or locations	Sign out everywhere
Recovery	Added email addresses or phone numbers	Remove unauthorized entries
Mail rules	Forwarding, filters, deleted-message actions	Delete suspicious rules
Connected apps	Unfamiliar services or permissions	Revoke access
Authentication	Missing or changed MFA methods	Re-enroll trusted methods

Remove Malware And Check Other Accounts

After securing the mailbox, scan the affected computer with reputable, updated security tools. Remove suspicious browser extensions, recently installed programs, scheduled tasks, and unfamiliar startup items. A full scan is more useful than relying on a quick scan when an information stealer or remote-access trojan is suspected.

Persistent threats may resist removal while Windows is running normally. This guide on using Safe Mode explains how starting Windows with a limited set of services can make malicious processes easier to identify and delete. Mac users should similarly inspect login items, browser profiles, configuration settings, and installed applications.

Do not assume that changing the email password solves the entire incident. Search for the same password in password managers, browsers, shopping accounts, social networks, cloud storage, banking services, and work portals. Change each reused credential from a clean device and activate multifactor authentication wherever it is available.

Protect Contacts And Sensitive Information

Tell contacts that messages sent during the compromise may be fraudulent. Ask them not to open attachments, follow payment instructions, or use links from suspicious emails. If the mailbox contains tax records, identity documents, password-reset messages, or business data, treat the incident as a possible privacy breach.

Check email archives for evidence of attempted fraud. Attackers may have searched for invoices, travel details, financial statements, or recovery codes before leaving the account. Contact banks, payment providers, employers, and relevant authorities when there is evidence of unauthorized transactions or identity theft.

Keep a written timeline of alerts, password changes, device scans, and suspicious activity. This record can help a provider’s support team investigate the takeover and can support an insurance, workplace, or law-enforcement report.

Priorities For The Next Hour

Work through the most urgent tasks in a deliberate order. Avoid mass-deleting evidence until you have recorded suspicious rules, logins, messages, and installed software.

• Disconnect the suspected infected device from the internet.
• Change the email password from a trusted device.
• Sign out all sessions and remove unknown recovery methods.
• Enable multifactor authentication and revoke unfamiliar applications.
• Scan and clean every device used to access the mailbox.
• Change reused passwords on financial, social, cloud, and work accounts.

Security information websites provide educational guidance, not a direct malware-removal service. Review the site’s security disclaimer before relying on general instructions, and seek qualified incident-response help when the compromise involves an organization or sensitive records.

Once the account is stable, monitor login alerts, forwarding settings, password-reset messages, and financial activity for several weeks. Keep software patched, use a password manager, avoid pirated applications, and treat unexpected attachments or login pages as potential phishing attempts. Begin the cleanup today, starting with a trusted device and the email provider’s official recovery tools.