Microsoft account compromised by chacroscmail.ru‎

The unknown chacroscmail.ru address is almost certainly an attacker-added alias or security info on the Microsoft account. To remove it and secure the account, follow these steps in order:

1. Clean the device and reset the password
   1. Run a full antivirus/malware scan on the PC first. If using Windows 10/11 or 8.1, turn on and run Windows Defender as described in the article.
   2. After the scan completes, sign in to the Microsoft account (if possible) and immediately change the password to a strong, unique one. If sign-in is blocked, reset the password.
2. Check for and remove attacker-added aliases
   1. Go to Manage how you sign in to your account: https://go.microsoft.com/fwlink/p/?linkid=842796
   2. Sign in to the affected Microsoft account.
   3. Under the list of aliases/usernames, locate any email address that is not recognized (for example, the chacroscmail.ru address).
   4. Select Remove next to that alias.
      • If the attacker’s address was set as primary, first choose another alias and select Make primary, then remove the attacker’s alias.
3. Fix security info and verification codes
   1. If verification codes are being sent to an address that is not recognized when signing in, follow the guidance under “I don't recognize the phone/email security info when signing in to my Microsoft account.”
   2. If the account is in a “security info change pending” state and the attacker replaced the security info, use the options on that pending screen:
      • Use Let us know if the change was not made by the account owner, to trigger the unauthorized-change flow.
      • If the change was initiated by the account owner and the old security info is still accessible, use Cancel this request.
   3. Once access is restored, add trusted security info (phone, alternate email, Microsoft Authenticator) and remove any unrecognized phone/email entries.
4. Review account activity and mailbox settings
   1. Check the Recent activity page from the Microsoft account dashboard to confirm any unusual sign-ins and mark them as “This wasn’t me.”
   2. In Outlook.com, review:
      • Settings → Mail → Rules and delete any suspicious rules.
      • Forwarding and Automatic replies pages and remove any unknown forwarding addresses or auto-replies.
5. If access is lost or codes always go to the attacker
   1. Use the official recovery flow for compromised accounts as described in How to recover a hacked or compromised Microsoft account.
   2. If the recovery form fails and the attacker has fully replaced the security info, there is no alternate supported method to regain access beyond the documented recovery process.

After regaining full control and removing the chacroscmail.ru address from aliases and security info, keep multi-factor authentication enabled and monitor for any new unrecognized verification-code prompts. Do not approve or respond to verification codes that were not requested.

References:

• How to recover a hacked or compromised Microsoft account
• Troubleshoot Microsoft verification code issues
• Add or remove an email alias in Outlook.com
• What happens if there's an unusual sign-in to your account
• My account got hacked. - Microsoft Q&A
• My account got hacked - Microsoft Q&A
• my microsoft account has been compromised - Microsoft Q&A
• Hacker set up continuous draft ransomware email - Microsoft Q&A