Yahoo Email Keeps Getting Phished

Question

I keep getting spam emails from myself (and I am sending them to others as well) on my Yahoo Mail account. I have already went through two password changes which I thought were secure. My very last one had 14 characters (although it consisted of two dictionary words) and a symbol. Is it just a case of my password consistently being cracked, or is something else going on?

Answer 1

There are a number of things that could cause your account to be hijacked. Generally speaking an insecure password is not high on the list unless its been taken from a site that was recently hacked. To prevent against this, make sure you do NOT reuse passwords on different sites.

What's more likely is that your computer has some kind of malware installed on it and is key-logging your passwords whenever you change them. In the case of spammers it's rare for them to manually target your account specifically (by say trying to reset your password using recovery questions etc).

I'd suggest using two factor authentication to sign into you email if you use a service like gmail that supports it.

I'd also suggest you check your computer for viruses/malware and ensure that any other devices you regularly log into (home/work/school etc PC's) are scanned as well.

Finally, its possible that someone might be intercepting un-encrypted login traffic if you are signing into something like hotmail where SSL isn't enabled by default. It's worth ensuring that your wifi traffic is encrypted and that users on any wired connection are trustworthy.

With any luck, one of the above recommendations will solve your problems. Good luck!

Edit: As rory has suggested, your account may be spoofed and not actually compromised. Check your outbox/sent items to see if the email has indeed come from you. It might also be worth while checking the mail headers to see if it comes from your network or from somewhere else.

Answer 2

Is this likely to be related to the Yahoo! Xtra breach that affected large numbers of people in New Zealand? (Hint: If you're an Xtra customer and use a @yahoo.co.nz or @xtra.co.nz email address regularly, the answer is probably yes!)

The initial breach was caused by a Cross Site Scripting vulnerability that should have since been fixed.

I would check the following:

1) Verify whether the emails are coming from your account, or are just pretending to be from your account. It may be easier to get an IT-savvy friend to help you with this step.

I would suggest the following actions:

2) Change your password immediately to a completely random sequence, no dictionary words please.

3) Go to your usual Yahoo! webmail account, and log out. Do this on all computers/devices that you regularly use. This will invalidate any successful XSS attacks.

4) Ensure your account security questions and recovery email addresses are not vulnerable to attack (Per Peleus).

Then wait and see for a few weeks - if the attacks persist it suggests something more interesting, in which case I would follow the advice given by D4M to thoroughly check for malware on your computers.

Answer 3

Almost certainly something else is going on.

Things to check (sorry not super knowledgeable about Yahoo's recovery options, some of these might be slightly off)

1. Change your security questions. It could be a case of someone simply knowing the answers to these and recovering your password, no matter what it is, via the "Forgot my password I'll answer questions instead" option.

2. Ensure that a secondary email hasn't been linked to your account. Some email clients offer the ability to send a "Forgot my password" email to a nominated account. If an attacker has placed his own in there it may lead to multiple compromises.

3. Update anti-virus along with downloading an alternative to your current one. It may be a situation where you have malware / keyloggers / stealers on your computer recovering your password each time you change it. If you don't want to go to the hassle of a full format, try changing your password on a different device from your main computer (i.e. mobile phone) and only check your email from there for the next few days. If it doesn't happen again there is a strong possibility they are recovering the password from your computer.

Answer 4

If they are not showing up as sent mail, then you are most likely being spoofed. It is entirely possible that you were compromised once and they downloaded your address book (or possibly compromised a friend who had a similar address book.) From there it is trivial to spoof the sender and send messages to anyone they want. I actually fairly regularly get e-mails claiming to be from one of my own e-mail accounts as most of my e-mail addresses are published on the Internet and I've only had one successful security breach on my computer and that was about 9 years ago.

So yes, this can and does happen even without being compromised directly. It is still work taking precautionary measures such as changing your password and running a full virus and malware scan on your system (preferably from a Live CD), but if nothing is found, I wouldn't worry about it beyond that.