Outlook Account Hijacked by Malicious OAuth Apps - Immediate Lock After Recovery

Question

Outlook Account Hijacked by Malicious OAuth Apps - Immediate Lock After Recovery

Abdullah Gawish 0

My Outlook account has been persistently locked due to suspicious activity triggered by malicious OAuth apps: Thunderbird, Get Any Token, and BHMailer. These apps were granted access without my consent and continue to hijack the account even after password resets. Every time I unlock the account, it is immediately re‑locked by Microsoft’s automated systems.

This is not a case of forgotten credentials or account takeover. I have:

• Successfully changed my password.

• Access to my verified alternate recovery channels.

• Active login session on my Windows device using this Microsoft account.

• Documentation and screenshots proving ownership and login activity.

The issue lies in persistent OAuth token abuse. I am unable to revoke these apps manually because the account locks before I can access the account.live.com/consent portal. The phone verification screen fails with the error:

“This method isn’t working right now. Try another.” — but no alternative method is offered.

I have submitted multiple recovery attempts and referenced several case numbers, including:

• SIR21221637

• SIR21463485

• SIR21463496

• SIR21220660

• SIR21221551

Despite repeated contact with support, I’ve only received scripted responses and been told that escalation is not possible — even though this is clearly a security incident, not a routine account issue.

✅ I am requesting:

• A manual server‑side revocation of all OAuth tokens and app permissions.

• Immediate unlocking of my account based on verified session and linked recovery info.

• Acknowledgment of the verification bug preventing phone unlock.

• Escalation to Microsoft Security Response Center (MSRC) or Trust & Safety.

I have already submitted a vulnerability report via MSRC and am prepared to escalate externally (GDPR, telecom regulators, consumer protection platforms) if this is not resolved promptly.

Thank you for your time and attention.

— Concerned Microsoft Account Holder

Case Ref: SIR21221637

Hornblower409 8,400 Reputation points

2025-11-22T11:36:53.99+00:00

@Abdullah Gawish

I will assume that you, or your IT, do not have access to Microsoft Defender for Office 365 and therefor can not use this technique.
https://learn.microsoft.com/en-us/defender-office-365/detect-and-remediate-illicit-consent-grants
Abdullah Gawish 0 Reputation points

2025-11-22T12:22:19.21+00:00

@Hornblower409
@JANSHER LIWAG
Thank you for sharing that resource. To clarify, my issue is not about lacking access to Microsoft Defender for Office 365 — the problem is that I cannot even reach the myapps.microsoft.com portal to review or revoke application access because my account is locked. The lock occurs immediately after sign‑in, so I am prevented from using the consent management tools that the documentation describes.

This is why I have emphasized that my case is a security incident rather than a routine recovery problem. Malicious OAuth apps (Thunderbird, Get Any Token, BHMailer) continue to hijack the account even after password resets, and the automated system re‑locks me before I can take any remediation steps.

What I need is manual server‑side token revocation and escalation to the Microsoft Security Response Center (MSRC) or Trust & Safety team, since Tier‑1 support has already confirmed they cannot assist. Without that intervention, I cannot access the portal or apply the remediation techniques you referenced.

@jan

2 answers

Your answer

Hornblower409 8,400 Reputation points

2025-11-22T11:36:53.99+00:00

@Abdullah Gawish

I will assume that you, or your IT, do not have access to Microsoft Defender for Office 365 and therefor can not use this technique.
https://learn.microsoft.com/en-us/defender-office-365/detect-and-remediate-illicit-consent-grants
Abdullah Gawish 0 Reputation points

2025-11-22T12:22:19.21+00:00

@Hornblower409
@JANSHER LIWAG
Thank you for sharing that resource. To clarify, my issue is not about lacking access to Microsoft Defender for Office 365 — the problem is that I cannot even reach the myapps.microsoft.com portal to review or revoke application access because my account is locked. The lock occurs immediately after sign‑in, so I am prevented from using the consent management tools that the documentation describes.

This is why I have emphasized that my case is a security incident rather than a routine recovery problem. Malicious OAuth apps (Thunderbird, Get Any Token, BHMailer) continue to hijack the account even after password resets, and the automated system re‑locks me before I can take any remediation steps.

What I need is manual server‑side token revocation and escalation to the Microsoft Security Response Center (MSRC) or Trust & Safety team, since Tier‑1 support has already confirmed they cannot assist. Without that intervention, I cannot access the portal or apply the remediation techniques you referenced.

@jan

Answer 1

JANSHER LIWAG 8,840 Independent Advisor

Hi Abdullah,

Thank you for posting, I am here to help. If you have attempted to recover your Microsoft account multiple times but were unsuccessful due to insufficient information, please get in touch with Microsoft Support for further assistance. Be sure to include the details of your recovery attempts, especially if your requests were denied despite providing accurate information.

Click on this page Contact - Microsoft Support

https://support.microsoft.com/en-us/home/contact

Please follow the steps below to contact Microsoft Online Support.

Go to the Microsoft Support page and search for “account locked.”

Scroll down and click “Sign in to contact Support.”

Sign in using a different personal Microsoft account.

Under Products & Services, choose “Other Products.”

Under Categories, select “Manage account security” and click Confirm.

Click “Chat with a support agent in your web browser” to start a live chat.

Source: https://learn.microsoft.com/answers/questions/4705510/how-can-i-access-my-account-when-it-says-i-havent?forum=outlook_com-all&referrer=answers

I hope you find this information helpful. Please let us know if you have any further questions If the answer is helpful, please click "Accept Answer".

Best regards,

Jansher

Abdullah Gawish 0 Reputation points

2025-11-21T20:57:37.7+00:00

Hello Jansher,

Thank you for your reply. To clarify: I do not need to recover my account — I already have the correct password, recovery email, and phone numbers. The issue is that my account is repeatedly locked by Microsoft’s automated systems due to malicious OAuth apps (Thunderbird, Get Any Token, BHMailer). This is a security incident, not a recovery problem. The phone verification method fails with “This method isn’t working right now,” leaving me unable to unlock the account despite valid credentials. In fact, the system does not accept Egyptian phone numbers at all — only when I use foreign numbers (US or German) am I able to temporarily unlock the account, but it is instantly re‑locked again due to the persistent OAuth tokens.

I have already contacted Microsoft Support multiple times and provided detailed recovery information, including case references (SIR21221637, SIR21463485, etc.), but Tier‑1 support has only repeated scripted steps and confirmed they cannot escalate consumer account cases. This is not a routine recovery issue — it is a security incident involving persistent OAuth token abuse. Malicious apps continue to hijack my account even after password resets, and the account is immediately re‑locked by automated systems. I am requesting escalation to the Microsoft Security Response Center (MSRC) or Trust & Safety team for manual server‑side token revocation. Please advise how this case can be routed to the appropriate security team, since Tier‑1 support has already confirmed they cannot assist. I appreciate your help in ensuring this reaches the correct escalation path.

The violation was triggered by malicious OAuth apps that were granted access without my consent. I have not violated any terms — the lock is caused by persistent token abuse and automated detection.

Answer 2

It seems you are experiencing a serious issue with your Outlook account being compromised by malicious OAuth applications. Here are some steps you can take to address the situation:

Revoke OAuth Tokens: Since you mentioned that you cannot access the consent portal due to the account being locked, you may need to contact Microsoft Support directly to request a manual revocation of all OAuth tokens associated with your account. Provide them with your case numbers and explain the urgency of the situation.
Account Recovery: Ensure that you have exhausted all recovery options available through Microsoft's account recovery process. If you are facing issues with phone verification, consider trying to recover your account using a different method, such as email verification, if available.
Security Measures: After regaining access, immediately enable multifactor authentication (MFA) for your account to add an extra layer of security. This will help prevent unauthorized access in the future.
Monitor Account Activity: Keep an eye on your account activity and any unusual behavior. If you notice any further suspicious activity, report it to Microsoft Support immediately.
Documentation: Keep all documentation regarding your recovery attempts and any correspondence with Microsoft Support. This will be useful if you need to escalate the issue further.

If these steps do not resolve the issue, you may need to escalate your case further within Microsoft Support or consider external avenues as you mentioned.

References:

Share via

Outlook Account Hijacked by Malicious OAuth Apps - Immediate Lock After Recovery

2 answers

Your answer