Yahoo Email Compromised But No Suspicious Activity

Question

A day ago noticed a bunch of [email protected] emails in my Yahoo inbox. I checked my sent folder, and it appears that someone sent emails to all my contacts in my contact books with the following URL in the body (do not visit)

asalchemi.com/uqysife.php

This is an email address I do not frequently use (I check once every couple of weeks), so I went to my recent activity which shows devices and IPs that have connected in the past 30 days, but there is nothing suspicious there - they're all IPs I recognize.

I do not use a mail client, such as Outlook or Thunderbird, only Yahoo mail in the browser, and on the iPhone.

My question is... how is it that without any recent activity did the hacker send an email without triggering any recent activity?

Answer 1

I guess you gave permission to some App to Read contacts/Send email via Yahoo OAuth. I Mean, you singed in to some website/application using Yahoo credentials via Yahoo.

So, Just using the Access token that got created at that time you gave permissions, Its possible to send emails to all your contacts using the API of Yahoo.

In this case the App dont need to Login with your credentials. The Access token will suffice.

If this is the case, you can fix it by removing permissions to that App.

Answer 2

I checked my sent folder, and it appears that someone sent emails to all my contacts in my contact books ... I went to my recent activity which shows devices and IPs that have connected in the past 30 days, but there is nothing suspicious there - they're all IPs I recognize.

Seeing such emails in your sent folder shows they have access to your account.

• Least likely: an unresolved vulnerability in the mail provider's system such as CSRF or XSS.

• Possible: The 'Recent Activity' from your mail provider could be incomplete / may not cover every possible endpoint of their web application. (API, SMTP direct, IMAP, specific AJAX requests)

  If this were the case, then an attacker could remotely attack your account with just a stolen password (i.e. Phishing), and your devices may be quite clean.

• You have malware on one of your devices.

Given a mail provider of this size, I suspect the latter to be the case.

1. Change your password immediately. This could easily be in the attackers hands even if the attack originated from your device.

2. Try to determine which device the attack may have originated from. I would expect that traditional computers to be a more likely attack vector than a Phone or Tablet, but either one is possible.

3. Take appropriate countermeasures to cleanse the suspect device(s)

   • On a more containerized OS like Android, Chromebook (and probably iPhone/iPad), then you can simply remove the app.

   • If malware was installed on a classical OS (Windows or Mac), then you need to wipe the OS.

     It is possible that Anti-Virus software will have this particular malware in its database, and will be able to remove it quite conveniently.

     I would nevertheless recommend a complete wipe so you know that you have been thorough.

While some malware acts as soon as it is installed, and can easily be found in your recent Downloads; other malware sits idle for a period of time before acting out. (i.e. first collects credit card numbers, and later shows popup ads) Such built-in delays would make it more difficult to understand how you obtained the malware in the first place.