My email is compromised how do i fix it

Hello

Do you find these "sent" emails somewhere in your sent box, or deleted items?

Make sure you do this on a computer, not on smartphone or tablet. Go to https://www.outlook.com and log in, click on the gear icon on the top right to launch the settings.

Then, on the Mail tab, go to Rules. Are there any rules set up here? If yes, delete them all.

Then check the conditional format, again, if it's there, delete it.

Then, check Forwarding and IMAP, If any items are present, delete them as well.

===========

If you can't find anything, go to https://account.live.com > Your info > Sign in Preferences. Make sure to check all the aliases here. If you don't recognize any there, delete it.

Then go to Security > Manage How I sign in, make sure all contact info is yours.

Please make sure you change your password and enable two-step verficiation.

Go to your account online, go to Devices, remove any devices you don't recognize.

Then go to Security, click on Sign out everywhere. This is meant to kill any session that's still connected. Unfortunately, this one will take 24 hours to take effect.

Then, take one step further - Go to your Microsoft account online https://account.live.com> Sign in > Your info > Sign in preference. Add an alias - You have two options here:

Create new: this will allow you to use the native domain outlook.com to create a new alias.

Add existing: this will allow you to add a 3rd party email address, such as yahoo, gmail, as long as they are not already associated with another Microsoft account.

Once added, make this new alias your primary alias, do NOT delete the old alias. Then at the bottom, click on "Change sign in preference". On the next page, uncheck the box for the old alias. This means, from now one, the old alias cannot be used to sign into your Microsoft account, but it can be still used to receive emails, etc.

If your email has been compromised and is sending phishing emails, follow these steps to secure your account:

1. Reset Your Password: Immediately change your email password to a strong, unique password. If your account is synced from Active Directory, ensure you reset the password there as well.
2. Enable Multifactor Authentication (MFA): If you haven't already, enable MFA for your account. This adds an extra layer of security and helps prevent unauthorized access.
3. Check for Suspicious Activity: Look for any unusual activity in your account, such as sent messages you didn't send, changes to your contacts, or any unfamiliar inbox rules that may be forwarding your emails to unknown addresses.
4. Revoke Access: Use PowerShell to revoke any active sessions for your account. This will log out any unauthorized access using your credentials. You can do this by connecting to Microsoft Graph and running the command to revoke sessions.
5. Review and Remove Inbox Rules: Check for any suspicious inbox rules that may have been created to forward emails or move them to different folders. Remove any rules that you did not set up.
6. Notify Your Contacts: Inform your contacts that your email was compromised and advise them not to click on any suspicious links or attachments they may have received from your account.
7. Scan for Malware: Run a malware scan on your devices to ensure there are no infections that could compromise your security further.
8. Monitor Your Account: Keep an eye on your account for any further suspicious activity and consider regularly changing your password and reviewing security settings.

By following these steps, you can help secure your email account and prevent further issues related to the compromise.

References:

• Respond to a compromised cloud email account
• Secure and Restore Email Function to a Compromised Microsoft 365 Mail Enabled Account