9,476 Contacts Harvested. The Real Risk of an Unmanaged PC

Every support desk dreads a particular kind of call. Last week we took one:

"My computer has been hacked and I can't access my email."

I want to walk through what happened next. Not to make heroes of our team (they are heros - but that's a different story), who did exactly what they are trained to do, but because the incident shows two things clearly.
- First, what modern, AI assisted IT support can do under pressure.
- Second, and more importantly, what it costs a business when a computer sits outside managed IT support until the day something goes wrong.

Details have been changed and removed to protect the client.
The timeline and the technical findings are real and extracted directly from the team notes and session transcripts.

The client who didn't need device support

The business is a small, owner-operated company. They had worked with us for years, but had chosen to look after their own computers. It is a decision we hear often, and it usually sounds reasonable:

"It's one PC. I know what I'm doing. I'll call you if something breaks."

That meant the computer at the centre of this incident had:

• No remote monitoring and management (RMM) agent, so we had no history or baseline to work from.
• A consumer antivirus product rather than managed endpoint detection and response.
• A leftover third-party remote access tool from years earlier.
• Day-to-day use on the Windows built-in Administrator account, with a password last changed in 2018.
• A business mailbox without multi-factor authentication.
• Windows process auditing switched off, which limits what the logs can tell you after the fact.

None of these is unusual on a self-managed PC.
Together, they gave an attacker everything they needed!

What actually happened

Once the investigation was complete, the sequence looked like this.

Day 1, mid-afternoon.
A remote access installer was downloaded and run on the PC. Within two minutes a second remote access client, pointing at an attacker-controlled server on an unfamiliar domain, had been installed as a backup way in. Both were legitimate commercial remote support software, the kind many IT providers use. Both were configured to hide themselves from the Installed Programs list and to reconnect automatically every time the PC started. The pattern is typical of a fake support call or a lure that tricks the user into running a "support" tool.

Days 1 to 5.
The attacker connected several times for short sessions, around 18 minutes in total, while the business carried on as normal. Nothing on the PC raised an alarm. The consumer antivirus recorded no detections.

Day 5, the morning of the call.
The attacker returned for a remote session of roughly 85 minutes. During it they transferred an email harvesting tool to the computer and ran it against Outlook. It produced a text file containing 9,476 unique email addresses, the business's entire contact history. Shortly after midday, a mass email went out from the business's own address. The flood of "Undeliverable" bounce messages that followed is what prompted the call to us.

At no point did the attacker need a password or a new Windows account. Remote access software rides on the existing desktop session, so the usual sign-in logs showed nothing unusual. This is exactly why a single "I'll keep an eye on it" PC is so hard to protect.

How AI assisted support changed the response

Because the PC was unmanaged, our first job was to install our monitoring agent and managed endpoint security. From that moment, Microsolve Assist, the AI agent that works alongside our technicians on every ticket, began a structured investigation.

Here is what that looked like in practice.

• Minutes, not hours, to find the root cause.
  Assist ran a full read-only triage in parallel: local accounts, administrator group members, scheduled tasks, startup items, services, live network connections, installed software, antivirus status and 30 days of security events. Within minutes it reported that two unapproved remote access clients were running, connected to external servers and set to start on boot. It flagged the self-hosted relay as an attacker pattern and recommended isolation straight away.
• Evidence first, cleanup second.
  Assist treated the PC as a crime scene. Before anything was removed, it exported the Windows event logs, copied both remote access clients' configuration folders and set up a dedicated evidence folder. When our engineer asked for the email harvesting tool to be deleted, Assist recommended quarantining it instead, renaming it so it could not run and recording its SHA-256 hash before and after the move. That evidence matters for insurers, the Australian Cyber Security Centre and any privacy assessment.
• A forensic timeline built from fragments.
  With process auditing switched off, Assist pieced together what happened from the remote access client's own logs, Windows Prefetch records, registry activity data, file timestamps and installer events. It established when the attacker got in, every session they ran, the three file transfers of the harvesting tool, the moment it first ran, the creation of the address list and how that lined up with the mass email. It separated confirmed evidence from reasonable inference and from unknowns, and it said so plainly each time.
• 73 minutes from agent install to eviction.
  Both rogue clients were uninstalled 73 minutes after our agent first reached the PC. Assist then verified the removal: no remote access services or processes left, no connections to the attacker's servers and our own tools untouched. A second live check later that afternoon confirmed the attacker had no way back in.
• Every action approved by a person.
  Assist does not act on its own. Every command it proposed, including every read-only check, went to our engineer as an approval card first. At one point Assist reported no evidence that the harvesting tool had run, then corrected itself when a fuller data set came back and flagged the correction clearly. That is exactly why we keep a human in the loop. The AI does the heavy lifting on data gathering and correlation. Our people make the calls.
• Documentation that writes itself.
  The full incident record, including the timeline, evidence hashes, indicators of compromise, actions taken and outstanding items, went straight into the ticket. The client received a plain-English summary the next day covering what we found, what we did and what they needed to do.

The whole response took 3 hours and 36 minutes of logged technician time. Without an AI agent correlating the evidence, an investigation of this depth would normally take a day or more.

Beyond the PC - containing the damage

The device was only half the problem. Our team also:

• Reset the business mailbox password, revoked every active sign-in session and set up multi-factor authentication.
• Checked mailbox rules and reviewed recent mail and files.
• Helped the client reset their accounting software and payment platform passwords, since both had been open during the attacker's session.
• Removed the old remote access tool and consumer antivirus and installed managed endpoint security.
• Advised the client to warn their contacts through a trusted channel, report the incident to the ACSC, notify their insurer, bank and accountant, and assess their obligations under the Notifiable Data Breaches scheme.

A mass send like this also damages a domain's sending reputation, which can affect whether legitimate email reaches customers for weeks afterwards. If you have been through something similar, our email reputation management service and our guide to SPF, DKIM and DMARC for Microsoft 365 are worth a look.

What managed support would have caught

This is the part that matters most for any business owner reading this. Almost every step of this attack would have been blocked, flagged or contained on a managed device.

Our AI assisted tech stack is powerful after an incident. It is far more valuable before one. On a device covered by our managed desktop support, Microsolve Assist has the device's history on hand, our monitoring sees changes as they happen, and the conversation on Day 1 is "we have spotted something unusual on your PC" rather than "your contacts have received a phishing email."

The financial gap between those two conversations is significant. We have written before about the real cost of cyber breach recovery for Australian businesses. That cost comes from notification, lost trust, disruption and cleanup, not from the IT invoice.

Lessons for small business owners

1. One unmanaged PC is an open door.
   Attackers do not need your whole network. One computer with your mailbox open is enough.
2. Legitimate tools get abused.
   The software used here is sold to IT providers every day. Only a managed environment knows which instances are yours.
3. Antivirus is not monitoring.
   The consumer product on this PC saw nothing wrong for five days.
4. Speed depends on preparation.
   We contained this in about an hour. On a managed device, it would likely have been stopped on Day 1.
5. Recovery is more than IT.
   Customers, insurers, banks and privacy obligations all need attention. Having a cyber incident response plan ready makes that far less stressful.

Where to start

If some of your devices sit outside managed support, the simplest first step is an IT health check. It shows where your gaps are before an attacker finds them. From there, our cyber security services and managed IT support for Sydney, the Illawarra  and regional NSW can close them, one device at a time.

Talk to our team about bringing every device under managed support, or see how to start working with Microsolve.