Capstone — Three Security-Flavored Support Tickets, Start to Finish

The forwarded email shows all the classic tells: a sender domain that doesn't quite match the real company, generic greeting, and a "Verify Now" button whose visible text doesn't match its actual destination — a textbook phishing attempt.

Near the end of the message, the user adds: "Actually, I did click it before I got suspicious, and I think I entered my password." What looked like a simple report-and-close ticket is now a suspected active compromise.

The technician documents the phishing email itself (headers, the mismatched link, when it was received and clicked) before touching anything else, then forces a password reset per Chapter 5's own safe procedure — no plaintext credential, delivered out-of-band — and checks for any signs of unauthorized activity since the click.

With the phishing email and the reset both documented, the finding is escalated through the organization's incident process, rather than treated as closed once the reset completes.

Taken alone, each notification could have an innocent explanation. Asking the chapter's own question — could this also be an early sign of compromise? — the technician checks the account's connected third-party applications rather than dismissing the notifications as noise.

An unfamiliar third-party app has standing access to the account's mail and files, authorized weeks ago through a login prompt the user doesn't specifically remember approving — a real, lesser-known attack pattern where a malicious app requests broad permissions through an otherwise-legitimate-looking consent screen.

The technician documents the app's name, permissions, and grant date, then revokes its access — stopping the ongoing exposure — while pulling only the specific account's own authorization records, not a broader export. The documented finding is escalated for further investigation into what the app may have accessed while connected.

Manufactured urgency, paired with an unverifiable backstory (a manager who isn't present, an account with no prior record the technician can check) — the same shape Chapters 1 and 3 both described, just delivered in person rather than by phone or email.

A password reset is high-risk regardless of channel. Rather than a badge or ID check alone — which can be faked the same way a phone number can be spoofed — the technician calls the claimed manager at an independently-looked-up number, not one the visitor provides.

The manager confirms no new hire is expected this week. The technician declines the request, documents the interaction, and locks their own workstation before stepping away to report it — the same basic habit Chapter 9 covered, applied without a second thought.