After a successful phish, a court clerk's mailbox now forwards all mail to an external Gmail address. What continuing attack should the analyst name?
Select an answer to reveal the explanation.
Short Explanation
The click got them in; the silent forward is how they stay in. A clerk mailbox shipping every message to outside Gmail is email compromise with a persistence rule, not last Tuesday's phish by itself. Hunt the rule, not just the original lure.
Full Explanation
A hidden inbox rule that forwards civic mail to an external account is mailbox persistence after the phish succeeded. That continuing activity is email compromise, not merely the initial click. Ransomware and watering-hole delivery would present encryption or browser-drive-by evidence, which this mailbox-rule finding does not show.