Oulook compromised

Question

Dear Microsoft Support Team,

I believe my Outlook account has been compromised. Here are the details of the issue:

• Symptoms:
  • Every time I receive an email, it immediately disappears from my inbox.
    • Every time I try to  create an email I get a message: Outdated Draft: this draft was deleted from another location. I have turned off all devices that may be running her mail account.
      • Emails do not appear in Sent Items, Deleted Items, or the Recover Deleted Items tool.
        • When I select an unread email, it disappears instantly.
          • I have checked and confirmed:

            - No forwarding rules or inbox rules are visible in Outlook Web.
            
                  - No sweep rules or blocked senders causing this behaviour.
            
                     - In __Junk Email settings__, I found two suspicious addresses under __Safe Senders and Domains__:
            
                           - `******@Mcatt1200.tg`
            
                                 - `******@Mcatt1200.tg`
            
                                       - Every time I delete these entries, they reappear.
            

• Actions Taken:
• Reset my email password twice
• Verified no forwarding settings.
• Checked and removed visible rules in Outlook Web.
• Attempted to remove suspicious Safe Senders entries (they persist).
• Checked add-ins (Manage Add-ins option not available in Outlook Web).
  • Enabled MFA and reviewed recent activity.
  • turned off all devices that WE Know have outlook either web app or outlook installed on
  • Concerns:
    • The persistent Safe Senders entries suggest a hidden mailbox rule or server-side compromise.
      • Emails disappearing immediately indicates possible malicious automation or retention policy manipulation.

Request: Please investigate and:

• Remove any hidden inbox rules or malicious configurations.
• Reset Safe Senders and Junk Email settings.
• Confirm if my mailbox has been compromised and secure it.
• Advise on any additional steps I should take.

Thank you for your urgent assistance.Dear Microsoft Support Team,

Answer 1

Hello Microsoft, please fix hacked accounts

Our accounts are now a guest tenant of 

******@Mcatt1200.tg 

and

******@Mcatt1200.tg

  running a malicious Active Directory Server or something. Only Microsoft it seems can resolve this. 

**Microsoft PLEASE  REMOVE guest user object and all associated policies from any external Entra ID tenants linked to our personal account."

Answer 2

Im Having the same Issue. I already did all those steps, and keeps coming back.

Any solution by Microsoft?

regards,

Answer 3

Hello

Hello,

Make sure you do this on a computer, not on smartphone or tablet. Go to https://www.outlook.com and log in, click on the gear icon on the top right to launch the settings.

Then, on the Mail tab, go to Rules. Are there any rules set up here? If yes, delete them all.

Then check the conditional format, again, if it's there, delete it.

Then, check Forwarding and IMAP, If any items are present, delete them as well.

===========

If you can't find anything, go to https://account.live.com > Your info > Sign in Preferences. Make sure to check all the aliases here. If you don't recognize any there, delete it.

Then go to Security > Manage How I sign in, make sure all contact info is yours.

Please make sure you change your password and enable two-step verficiation.

Go to your account online, go to Devices, remove any devices you don't recognize.

Then go to Security, click on Sign out everywhere. This is meant to kill any session that's still connected. Unfortunately, this one will take 24 hours to take effect.

=========

If you have done all of the above, consider running an offline scan on all devices you use, as this can be related to some local script on your computer.

Go to Settings > Privacy & Security > Windows security > Virus and threat protection > Scan options > Microsoft Defender Antivirus (offline scan). Then click on the Scan now button to start it.