Start with facts, not assumptions
Confirm which device was used, when the link was opened and what appeared afterward. Determine whether the user entered a password, approved an MFA prompt, scanned a QR code, downloaded a file or opened the link from another device. Those details determine the scope of the incident.
Protect the identity
If credentials may have been exposed, reset the password, revoke active sessions and review authentication methods. Check recent sign-ins for unfamiliar locations, devices and applications. MFA reduces risk, but a stolen session or approved malicious prompt can still require containment.
Evaluate the endpoint
Review endpoint security telemetry and browser/download activity. If malicious code may have executed or the device cannot be trusted, rebuilding the endpoint from a known-good state can be safer than trying to prove every artifact was removed.
Review what changed
Check mailbox rules, forwarding, application consent and other persistence mechanisms relevant to the account. The goal is not only to stop the immediate incident, but to verify that access was not retained elsewhere.
Close the loop
Document what happened, what was checked and what was changed. Then use the incident to improve controls, user awareness and response procedures without turning a single mistake into a blame exercise.