What to Do If You Clicked

Containment means: stop giving the attacker more. Close the tab. Do not keep browsing "to see if it looks real." Do not type the password again to "check." Do not download the "secure viewer" the page offered. If you opened the link on a computer and the page tried to run a file or install a browser extension, treat that as malware-possible: disconnect Wi-Fi or unplug Ethernet so the box cannot talk out while you switch to a device you still trust. A click without a typed secret is still an incident, just a smaller one. The page may have dropped a cookie, a tracking pixel, or a drive-by prompt. Closing the tab is the first control. A click plus a typed password is a credential incident: assume the attacker has the pair until you rotate it on the real service. A click plus an OTP you typed is worse — they may already be inside. Containment is the same shape either way: stop using the poisoned session, then recover from a session you initiated on a site you typed.

Do not use the fake page's "log in again," "call this number," or "chat with support" buttons. Those are the attacker's helpdesk. Do not reply to the original email or text to "cancel." Cancellation via the bait is how pig-butchering and smishing keep you on the hook. If you fear the device itself is dirty (unexpected installer, new browser profile, MDM/config profile you did not add), do the password work from another phone or computer you own — or after guidance from your workplace IT. You are recovering YOUR login. You are not scanning the scammer's server.

Password change happens on the genuine origin. That means you type the brand yourself (bookmark, password-manager fill from a saved official URL, or the address you already know) — you do not click "reset password" on the phishing page. Topic 4 already taught uniqueness: if that password was reused, the fake page did not steal one site; it stole a skeleton key. Rotate the typed account first, then every reuse of that same secret, starting with email and banking. Generate the new secret in the manager. Do not invent a "hard" variant of the old one. Do not paste the new password into chat, tickets, or a "helpful" friend. If you cannot remember whether you reused it, assume you did for email, cloud, and money apps until you prove otherwise in the vault. That is not paranoia; it is how stuffing works. The manager is the blast-radius tool: one generated string per origin. Changing the password on the fake domain does nothing — that domain is not your bank.

Turn on MFA (authenticator app or security key preferred; SMS is better than nothing and weaker than TOTP) on the account you just rotated, then on the mailbox that can reset it. MFA does not un-send the password you already typed. It stops the next login that only has the password. If the attacker already completed MFA because you typed an OTP into the fake form, password change plus session revoke is the pair that kicks them out — MFA alone on a session they already hold is a sticker on an open door.

Session revoke is the control people skip because it is buried. After a phished login, the attacker may already have a live cookie: "Signed in on Chrome · Windows · city you have never visited." Use the account's Security / Devices / Active sessions page on the REAL site you typed, and sign out everything except the device in your hand. Then sign in again yourself. That is not optional cleanup. That is kicking a guest out of a house whose key you just changed. Email forwarding rules and inbox filters are the quiet persistence trick: a rule that sends a copy of every message to an address you do not know, or that hides mail from your bank. Open Settings → Forwarding / Filters / Rules on YOUR mailbox. Delete anything you did not create. Check recovery email and recovery phone — Topic 4 recovery — so the attacker cannot reset you after you lock the front door. If the phish named a bank, card, wallet, or payroll site, open THAT institution the same way: typed official site or the number printed on YOUR card. Look for new payees, new devices, new cards, crypto sends, gift-card purchases. Freeze or dispute through that official channel. Do not call a number that arrived in the bait.

If money moved, speed still beats shame. Banks and cards have limited windows. You are filing a fraud report on YOUR account, not hunting the wallet. If work systems were involved (SSO, VPN, payroll), tell IT with facts: time, what you typed, what you clicked. You are not "in trouble" for reporting; you are containing blast radius for the org. If a family shared password was typed, rotate that too — still only accounts you jointly own, still no "checking" a relative's mail without them.

This is a notes lab, not a live phish. You will not visit a malicious URL to "practice clicking." You will not enter a real password into this app. You will write the order you will actually follow on accounts you own, then chmod 600 so the file is not world-readable on a shared box. If you have never clicked a phish, you still want the sheet — incident response that starts after panic is too late.

mkdir -p "$HOME/cyberlium-lab"
NOTES="$HOME/cyberlium-lab/phishing-15min.txt"

{
  echo "phishing 15-minute checklist — MY accounts only"
  echo "date: $(date -Iseconds 2>/dev/null || date)"
  echo ""
  echo "0. SHAME DELAY: I will not wait. Freeze helps the attacker."
  echo "1. CONTAIN: close the fake tab. Do not keep browsing it."
  echo "   If installer/profile appeared: disconnect Wi-Fi / unplug Ethernet."
  echo "   Continue from a device I trust (second phone/computer I own)."
  echo "2. REAL SITE: type the brand myself or use password-manager official URL."
  echo "   NEVER click reset/login on the phishing page."
  echo "3. PASSWORD: generate a new unique secret in the manager for that origin."
  echo "   If reused: rotate email + bank + every copy of that secret next."
  echo "4. MFA: turn on authenticator/key (SMS if that is all the site offers)."
  echo "5. SESSIONS: Security → devices / active sessions → sign out others."
  echo "6. MAIL: forwarding rules, filters, recovery email/phone — mine only."
  echo "7. MONEY: if bank/card/wallet named, official site I typed or number on MY card."
  echo "   Look for new payees, devices, cards. Dispute via that channel."
  echo "8. WORK: tell IT time / what I typed / what I clicked — facts, not revenge."
  echo ""
  echo "ETHICS (write these so I remember under stress):"
  echo "Recovery = MY accounts. No hack-back. No doxxing. No revenge."
  echo "No scanning the phishing host. No reset on accounts I do not own."
} > "$NOTES"
chmod 600 "$NOTES"

ls -l "$NOTES"

You now treat a phishing click as a timed incident: contain the fake page, rotate on the real origin you type, add MFA, revoke sessions, inspect forwarding, and call money channels that already belong to you. Shame is delay. Revenge is out of scope. Next — How to Report Scams — you will use platform report buttons, bank fraud lines, and evidence you already have so other people are not the next click, still without forwarding malware or inventing government URLs.