Account takeover is the starting point for most email fraud and many breaches. The attacker gets in with a stolen password, a stolen session or a tired MFA approval, then stays quiet.
Inside, they read mail to learn who pays whom, set rules to hide replies and wait for the right moment to ask for a payment or reach other systems.
Common signs
- A sign-in from a country or device the person never uses
- New inbox rules that forward or delete mail
- The person says they did not get replies they expected
How Centeye handles it
Centeye Gatewatch ends every session, resets the password and sign-in methods, and removes what the attacker added.
Gatewatch: identity protection (ITDR) →