What to Do If Your Rebel Cloud Email Account Is Compromised?

Step 1: Immediate Containment – Change Password & Audit Account Settings

Critical Safety Note: If you suspect malware, a keylogger, or an info-stealer is present on your computer, perform this password reset from a secondary, clean device (such as a mobile phone using cellular data or a completely separate, clean computer). Changing your password from an infected machine will immediately hand the new password back to the attacker.

Password Reset & Portal Settings Audit:

1. Go to Rebel.com (or Rebel.ca) and click Account Sign In / Up in the top-right corner.
    
2. Enter your Rebel username and password. Complete the multi-factor authentication (MFA) verification code sent to your phone or backup email (ensure you do not send the verification code to the compromised email address).
    
3. Once logged in, you will land in your domain manager dashboard (/en/dashboard/products/domains).
    
4. Near the top of the portal under Products (beside the Rebel logo), click on Email (the 3rd tab, situated directly beside Hosting).
    
5. On the very far right of the page, click Manage Subscriptions.
    
6. Find the affected email address, look to the far right side, and click Manage.
    
7. Click on Settings on the far right:
   • Change Password: Select Password Change. Enter a strong, unique new password (at least 12 characters combining uppercase, lowercase, numbers, and symbols) and save your changes.
      
   • Check Email Forwarding: While still in this settings area, inspect your forwarding destinations. If an unauthorized forwarding address has been set up, remove it immediately.
      
   • Check Auto-Responder: Review auto-responder settings to ensure no unauthorized out-of-office message or phishing response has been activated.
      
   • Audit Aliases: Check the alias section to ensure the attacker did not attach unauthorized secondary email aliases to your mailbox.

Step 2: Audit Webmail Message Rules (mail.rebel.com)

1. Navigate to mail.rebel.com.
    
2. Log in with your email address and your newly updated password.
    
3. In the top-left corner of the screen, click the Menu icon (the "hamburger" icon with 3 horizontal lines stacked on top of each other).
    
4. Click Settings.
    
5. Select Mail from the settings menu.
    
6. Scroll down to locate Rules.
    
7. Click on Rules and review the entire list. Delete any unrecognized rules immediately.

Step 3: Device Security & Malware Elimination

For Windows:

1. Run a Full Antivirus Scan:
   • Open Windows Security > select Virus & threat protection.
   • Under Scan options, choose Full scan and click Scan now.
   • Download and run a secondary, standalone scanner such as Malwarebytes for Windows to detect stealth adware, token hijackers, or rootkits that traditional scanners may overlook.
2. Audit Startup Applications:
   • Press Ctrl + Shift + Esc to open Task Manager.
   • Select the Startup apps tab on the left sidebar.
   • Review all programs configured to launch at boot. Disable any unfamiliar application, executable, or program lacking a verified publisher.
3. Inspect Active Processes:
   • Open the Processes tab in Task Manager and review background tasks showing unexplained, sustained CPU or network utilization.

For Mac (macOS):

1. Run a Dedicated Malware Scan:
   • Download and install the software using the Malwarebytes for Mac Installation Guide.
   • Run a comprehensive scan to locate and quarantine unwanted background daemons, adware payloads, and hidden launch agents.
2. Review Login Items & Background Daemons:
   • Go to System Settings > General > Login Items & Extensions.
   • Review both the Open at Login list and the Allow in the Background list. Toggle off any application, script, or developer utility you do not recognize.
3. Inspect Browser Extensions:
   • Open your installed browsers (Safari, Chrome, Firefox, Edge) and go to their respective Extensions/Add-ons managers. Remove any third-party extensions you did not intentionally install.

For Mobile Devices (iOS & Android):

• Android: Open the Google Play Store > tap your profile icon in the top-right > select Play Protect > tap Scan. Additionally, check your device application manager and uninstall any sideloaded APKs or unrecognized apps.
   
• iPhone / iPad (iOS): Open Settings > General > VPN & Device Management. Verify that no unknown configuration profiles or third-party Mobile Device Management (MDM) certificates are installed. If any unfamiliar profile exists, tap it and select Remove Profile.

Step 4: Re-authenticate Your Email Clients

• Classic Outlook for Windows: Open Outlook. When prompted by the credential dialog, enter your new password. If no prompt appears, navigate to File > Account Settings > Server Settings to update your incoming (IMAP/POP) and outgoing (SMTP) passwords (for reference, see the Microsoft guide on changing or updating email account settings in Outlook for Windows).
   
• New Outlook for Windows: Click Settings (gear icon) in the top right > select Accounts > locate your Cloud email address and click Manage. Scroll down to the bottom of the page, click Repair, and enter your new password in both the incoming password field and the outgoing SMTP Password field. Do not modify your existing hostnames or port numbers—those settings remain untouched.
   
• Apple Mail (macOS): Open Apple Mail > go to Mail in the top menu bar > Settings > Accounts > select your mailbox > re-enter your new password in the incoming server settings and the outgoing (SMTP) server settings.
   
• Apple Mail (iOS / iPadOS): Open Settings > scroll to Apps > Mail > Mail Accounts > tap your Cloud account > enter your new password for both the incoming mail server and the primary outgoing SMTP server.
   
• Android (Gmail, Samsung Email, Outlook App): Open your email app > go to Settings > tap your account > navigate to Server settings or Incoming/Outgoing settings > update both server password fields.

Step 5: Post-Incident Checklist & Next Steps

1. Notify Key Contacts & Clients: If unauthorized spam, fake invoices, or suspicious phishing links were sent from your address during the breach, reach out to your frequent contacts, vendors, and clients. Advise them that your account experienced an unauthorized intrusion, has now been secured, and that any links, attachments, or banking/payment change requests received during the compromise window should be deleted immediately.
    
2. Audit Associated Online Services: If this email address acts as the primary recovery email for critical external platforms (such as your domain registrar, online banking, payment gateways, accounting software, or corporate portals), log in to those platforms immediately. Review recent login history, check for unauthorized password reset emails, and update your passwords across those services.
    
3. Practice Strong Password Hygiene: Never reuse passwords across multiple services or use your portal password as your mailbox password. We strongly recommend using a reputable password manager (such as Bitwarden or 1Password) to generate and store randomized credentials.
    
4. Contact Rebel Support: If your domain or mailbox was temporarily rate-limited, greylisted, or suspended by our outbound mail filters due to an automated spam surge during the compromise, reach out directly to our support team once you have completed the containment steps above. Our team will document the case and coordinate directly with our hosting/email engineering team to perform a complete systems sweep—purging any remaining malicious messages stuck in outbound queues, verifying your DNS authentication records (SPF, DKIM, and DMARC), confirming that your domain reputation is protected, and restoring normal outbound delivery.