A user opens a phishing email and types logon credentials into a fake banking website. The computer's antivirus software then reports it has several from the network. Which of the following should…

Changing the password immediately is the highest-priority action because the attacker now possesses valid credentials that can be used to access the real banking account from any external system, regardless of whether the local machine is cleaned. Every minute the old password remains valid increases the window for financial harm. Malware remediation is important but secondary to revoking the attacker's access.

Updating antivirus and running scans addresses local malware but does not invalidate the stolen credentials, which the attacker can use from their own system entirely outside the victim network.

Disabling the local computer account prevents local logon but has no effect on external accounts such as online banking whose credentials were submitted to the phishing site.

Quarantining the phishing email prevents future interaction with it but does not help because the credentials have already been submitted and received by the attacker.