What are the signs that a compromised account is still active?

How to read the warning pattern

A compromised account is often still active when the attacker is using it just enough to avoid obvious disruption. The clearest clue is not one event but a pattern: logins from unfamiliar places or devices, repeated changes to forwarding or recovery settings, and account activity that does not match the user’s normal business rhythm. That combination suggests live use, not just stale compromise.

The practical distinction is between a one-time intrusion and an account that remains under someone else’s control. If you keep seeing authentication events, mailbox rule edits, password-reset attempts, or other behaviour after the first alert, treat the account as an active access path and assume the attacker is testing how much time they still have.

What activity patterns usually expose ongoing compromise?

Ongoing compromise tends to show up as behaviour that is technically valid but operationally odd. A user may still be able to sign in, yet the access comes from a new country, an unusual IP range, a different browser profile, or a device that was never enrolled by the real user. In email and collaboration platforms, mailbox forwarding, inbox rule creation, deleted security notifications, and suspicious consent or delegation changes are especially important because they let an attacker persist without repeated logins.

Reset requests and account recovery changes are another strong signal because they often indicate the adversary is trying to lock in control. Watch for repeated MFA prompts, unfamiliar authenticator enrollment, password changes shortly after login, and access outside the usual time window. These signs matter most when they appear together, because a single anomaly can be noise, but several aligned anomalies usually indicate an actor who is still operating inside the account.

When does the behaviour become a containment decision?

The threshold is crossed when the anomalies explain each other. If the login geography, device fingerprint, forwarding behaviour, and business-pattern drift all point in the same direction, the account should be treated as active compromise rather than a benign anomaly. At that point, the question is no longer whether something happened, but whether the attacker still has a path to persistence, data access, or lateral movement through the account.

That matters because compromised accounts are often used quietly first. An attacker may read mail, wait for a payment or reset opportunity, search for privileged contacts, or use the account as a trusted relay. If the account still has functioning sessions, tokens, delegated access, or rule-based forwarding, containment has to focus on cutting those paths quickly, not just resetting the password and hoping the issue ends.

Risk and Threat Considerations

A compromised account that remains active is a live trust problem, not a historical incident. The main risk is that the attacker can continue using legitimate access to avoid detection, retain persistence, and expand to adjacent systems through inboxes, sessions, or approval workflows.

Failure mechanism: The defender sees isolated alerts, but the attacker keeps valid access through a session, token, forwarding rule, or repeated recovery attempt, allowing continued use without obvious lockout.

Impact: Persistent access can lead to mailbox abuse, data theft, fraudulent requests, privilege escalation, and secondary compromise of people or systems that trust the account.

Practitioner Guidance

What to verify: Confirm whether the suspicious activity is clustered around a live sign-in path, active session, or persistent mail rule. If the account still generates successful logins, rule changes, or reset activity after the first alert, assume the compromise is ongoing until proven otherwise.

Decision rule: If you can explain the activity as a one-off anomaly, investigate; if you cannot explain the pattern as user-normal behaviour, isolate the account, revoke sessions, remove forwarding and delegation, and force credential reissue before returning access.

Practitioner takeaway: Treat repeatable behavioural anomalies as the signal that matters most, because active compromise is usually revealed by persistence patterns, not by a single suspicious login.

Related resources from NHI Mgmt Group

• What are the signs that an Azure account takeover campaign is still active inside an organisation?
• What actions should I take if my OAuth tokens are compromised?
• Why do still-valid secrets matter after public disclosure?
• How should teams respond when a service account token is exposed?