What to do if you entered your password on a fake login page

Many phishing pages today are adversary-in-the-middle (AiTM) proxies. They pass your password and MFA code through to the real Microsoft or Google sign-in page in real time and keep the session token that comes back. With that token the attacker is signed in as you, often without ever needing your password again. Microsoft documents this as token theft and publishes a separate playbook for it.

That's why the order of steps matters: changing the password doesn't always end sessions the attacker already holds.

1. 01

   Tell IT immediately

   Say exactly when you entered the details and on what page. If you're the admin, do the steps below now.

2. 02

   Reset the password from a clean device

   Use a new, unique password. If the account syncs from on-premises Active Directory, reset it there; Microsoft advises resetting it twice in that case.

3. 03

   Revoke all sessions

   In Microsoft 365, an admin can revoke sign-in sessions and refresh tokens (for example, the Revoke-MgUserSignInSession command in Microsoft Graph PowerShell, or 'Revoke sessions' on the user in the Entra admin centre). In Google Workspace, an admin can sign the user out of all sessions from the user's security settings.

4. 04

   Delete app passwords

   Microsoft notes that app passwords aren't revoked automatically when the password is reset.

5. 05

   If you can't do the above quickly, block sign-in

   Disabling the account temporarily stops further access while you work.

• Sign-in logs: look for successful sign-ins from unfamiliar countries, hosting providers or devices around and after the time of the phish.
• Inbox rules, including hidden ones: rules that forward mail, delete it, or move it to folders like RSS Subscriptions or Notes are classic attacker tricks.
• Mailbox forwarding and delegates: external forwarding addresses and new mailbox permissions.
• MFA methods: attackers often register their own phone or authenticator app so they can return. Remove anything the user doesn't recognize.
• Admin roles: if the account had admin rights, widen the investigation to the whole tenant.

Some phishing campaigns ask you to 'accept' an app rather than enter a password. A consented app can read mail and files through the API even after a password reset. Review enterprise applications with user consent in Microsoft Entra ID (or third-party app access in Google Workspace) and revoke anything unexpected. Microsoft's app-consent incident response playbook covers this in detail.

Check Sent Items and the message trace for mail sent during the compromise window. Attackers frequently use a hijacked mailbox to phish the victim's contacts or send altered invoices.

If anything went out, warn recipients by phone or from a clean account, with a plain message: what they may have received, that they shouldn't click or pay, and who to call. If an attacker read mail containing personal information, the incident may also be a privacy breach that needs assessment and a breach record.

Codes sent by text and 'approve' push prompts can be relayed by AiTM kits. Passkeys, FIDO2 security keys and Windows Hello for Business are bound to the real site and can't be replayed through a fake one. Pair them with Conditional Access policies that require a compliant device, and you close most of this attack path.

Report the phishing page to your IT team so it can be blocked across the organization, and to the Cyber Centre if it was a targeted campaign.