5

I have a Google Apps email (Gmail with my own domain) - let's call it [email protected].

3 days ago many people in my address book were sent a spam email FROM my [email protected] account.

When I logged into the web app (I use Outlook on the desktop to manage my email) these emails didn't appear in the sent items.

I changed all the passwords but now 3 days later another group spam message has gone out.

Again nothing is in the sent items. It surprises me that these messages are getting through at all if the email is just being spoofed.

How can I get to the bottom of this and stop these messages being successfully sent. How can I know if I've been hacked?

Improve this question
4
  • 1
    It seems your email address has just been spoofed (and there is nothing you can do to stop that). If you want to check if you are hacker, check the login activities (last time you checked your email) by writing down the last time you logged into your message account for comparison (login activities)
    – user45139
    Sep 19, 2015 at 10:27
  • It could be - although many people from the Outlook address book had emails sent to them - so I think it's something more than just a spoofed email... There are no suspicious login activities.
    – niico
    Sep 19, 2015 at 12:09
  • 1
    Google Apps will have a log of the emails sent even if they were deleted from the 'sent email' queue. Use the Google Apps admin interface instead of a 3rd party email client.
    – schroeder ♦
    Sep 19, 2015 at 18:10
  • I have looked in the web interface - there is nothing in sent items or the 'bin' - is this definitive proof they did not send using a valid login?
    – niico
    Sep 19, 2015 at 20:56

1 Answer 1

Reset to default
8

It is more likely that your email address is being spoofed than your account is actually hacked, though either is a possibility.

Spoofer scenario: Because there are users from your contact list being sent emails from your account, it means that a spoofer likely got access to some of your emails and stole the recipient lists from them. They do this because spam that appears to come from someone you know is more likely to be read by the recipients. If this is the case, there's nothing that you can do to stop it though you can explain the situation to the recipients.

Hacked account scenario: It is possible that a hacker has somehow gotten access to your Google Apps account. You can check check your recent Google logins to see if you see anything suspicious. If you do find suspicious activity it may indicate specific actions need to be taken to correct the problem. Whether or not you see abnormal logins, there's no harm in being safe. Change your Google Apps password. Make it something random and definitely don't just change a character or two from your current password. You can also enable 2-factor authentication on the account. You may also want to change the password on your computers and lockscreens on your mobile devices just in case someone hacked them (seems extremely unlikely to me but changing passwords is pretty easy).

Improve this answer
6
  • Shouldn't spam checking software filter out the majority of spoofed email these days - specially with obviously harmful spam content (which these emails had)? Password was changed the first time - and it happened again, and we changed it again. It's possible a machine has been compromised - we are no longer using that machine.
    – niico
    Sep 19, 2015 at 20:57
  • Nothing suspicious in logins.
    – niico
    Sep 19, 2015 at 20:57
  • Spam checkers do block most spam. But not this one. We know that because people got it.
    – Neil Smithline
    Sep 19, 2015 at 20:59
  • But did they get it because the email was sent from the real logged in account & SMTP server - or because it was spoofed and somehow got round them?
    – niico
    Sep 19, 2015 at 23:34
  • It could be either.
    – Neil Smithline
    Sep 19, 2015 at 23:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .