Problem description
1. The mailbox is compromised and the password has been leaked.
2. The mailbox is not compromised. Attackers use technical methods, such as the Simple Mail Transfer Protocol (SMTP), to spoof the sender address for blackmail or phishing.
Solutions
First, see How to determine if your mailbox is compromised? to check if your mailbox is compromised.
Actual theft
1. Change your mailbox password as soon as possible. If you cannot change it immediately, contact your mailbox administrator to freeze the sender address.
2. Use the revoke email feature to revoke abnormal emails and mitigate the impact. For more information, see How can a mailbox administrator revoke an email?
3. Set IP restrictions for logon. For more information, see Receive unusual logon notifications in Alibaba Mail.
4. Check if any automatic forwarding or inbound mail rules were set up on the account without your knowledge. If so, delete them.
5. Run a security scan on the devices used to log on to the mailbox.
6. Enable security passwords for third-party clients on the affected accounts. For more information, see How can a domain administrator enable security passwords for third-party clients?
7. Report the relevant emails.
Other global operations: Administrators should enable these features with caution after an assessment to avoid affecting other employees.
1. Enable multi-factor authentication (MFA). For more information, see What is multi-factor authentication?.
2. Prohibit the use of third-party clients. For more information, see How can a domain administrator enable security passwords for third-party clients?
3. Other security measures. For more information, see Alibaba Mail security features.
Spoofed sender (not an actual compromise)
1. The standard SMTP allows the display sender to be different from the actual sender.
Check the original email source to find the actual sender (in the MF or mailfrom field). If the address belongs to an employee in the same domain, change the mailbox password immediately.
For more information, see How to view or download the original source of an email?
2. `AC=SPAM` indicates that the anti-spam system has identified the email as spam. Advise employees to set their custom anti-spam settings to "High". This will intercept such emails and deliver them to the spam folder.
If an email is not marked as spam, you can use the email filtering feature. Use this feature with caution to avoid incorrectly blocking legitimate emails.
Also, report the relevant emails.
