5

I have a Google Apps email (Gmail with my own domain) - let's call it John@example.com.

3 days ago many people in my address book were sent a spam email FROM my John@example.com account.

When I logged into the web app (I use Outlook on the desktop to manage my email) these emails didn't appear in the sent items.

I changed all the passwords but now 3 days later another group spam message has gone out.

Again nothing is in the sent items. It surprises me that these messages are getting through at all if the email is just being spoofed.

How can I get to the bottom of this and stop these messages being successfully sent. How can I know if I've been hacked?

  • 1
    It seems your email address has just been spoofed (and there is nothing you can do to stop that). If you want to check if you are hacker, check the login activities (last time you checked your email) by writing down the last time you logged into your message account for comparison (login activities) – user45139 Sep 19 '15 at 10:27
  • It could be - although many people from the Outlook address book had emails sent to them - so I think it's something more than just a spoofed email... There are no suspicious login activities. – niico Sep 19 '15 at 12:09
  • 1
    Google Apps will have a log of the emails sent even if they were deleted from the 'sent email' queue. Use the Google Apps admin interface instead of a 3rd party email client. – schroeder Sep 19 '15 at 18:10
  • I have looked in the web interface - there is nothing in sent items or the 'bin' - is this definitive proof they did not send using a valid login? – niico Sep 19 '15 at 20:56
8

It is more likely that your email address is being spoofed than your account is actually hacked, though either is a possibility.

Spoofer scenario: Because there are users from your contact list being sent emails from your account, it means that a spoofer likely got access to some of your emails and stole the recipient lists from them. They do this because spam that appears to come from someone you know is more likely to be read by the recipients. If this is the case, there's nothing that you can do to stop it though you can explain the situation to the recipients.

Hacked account scenario: It is possible that a hacker has somehow gotten access to your Google Apps account. You can check check your recent Google logins to see if you see anything suspicious. If you do find suspicious activity it may indicate specific actions need to be taken to correct the problem. Whether or not you see abnormal logins, there's no harm in being safe. Change your Google Apps password. Make it something random and definitely don't just change a character or two from your current password. You can also enable 2-factor authentication on the account. You may also want to change the password on your computers and lockscreens on your mobile devices just in case someone hacked them (seems extremely unlikely to me but changing passwords is pretty easy).

  • Shouldn't spam checking software filter out the majority of spoofed email these days - specially with obviously harmful spam content (which these emails had)? Password was changed the first time - and it happened again, and we changed it again. It's possible a machine has been compromised - we are no longer using that machine. – niico Sep 19 '15 at 20:57
  • Nothing suspicious in logins. – niico Sep 19 '15 at 20:57
  • Spam checkers do block most spam. But not this one. We know that because people got it. – Neil Smithline Sep 19 '15 at 20:59
  • But did they get it because the email was sent from the real logged in account & SMTP server - or because it was spoofed and somehow got round them? – niico Sep 19 '15 at 23:34
  • It could be either. – Neil Smithline Sep 19 '15 at 23:47

protected by Community May 3 '16 at 16:45

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.