I entered my work password on a phishing page. What now?
Treat the account as compromised and act within a few minutes. Change the password from a trusted device, and if you used the same password anywhere else, change it there too. Ask IT to sign the account out of all sessions and revoke its access tokens, because many phishing kits steal the logged-in session itself, so a new password alone may not lock the attacker out. IT should then check the sign-in log for logins from unfamiliar places, review the MFA methods for a new phone or app the attacker may have added, and look for new inbox rules that forward or hide mail. If the account has administrator rights or access to finance systems, raise the priority accordingly. Identity steps come first here. Network monitoring helps afterwards, by watching for the follow-on activity a stolen login often leads to, such as remote access to internal servers.
Read next
Related questions
- An employee entered their password on a phishing page. What should we check on the network?
- How do you clean a computer after a phishing click?
- After a phishing click, how do attackers get from one laptop to the rest of the network?
- Should employees report a phishing e-mail even if they did not click it?
- Does security awareness training stop phishing?
← All 29 questions on Phishing and e-mail aftermathAll topics