Access and persistence

The account had suspicious successful access alongside repeated failed sign-in attempts. I investigated the access timeline, an added MFA method and mail-filtering rules. The authentication method offered a way to maintain account access; the rules could conceal relevant messages. The record does not establish a particular MFA-bypass technique.