Getting spam emails from myself which I never sent, regconized by Outlook as "drafts" email, i have been hacked. on both my Emails. as the email to recover has been changed.

Question

Dear team,

I've received email from "myself" that goes in to "drafts" which is threatening to release videos/pictures of me it has been spamming these for the past 12h now. I understand this is spam email. And I checked my account activities during recent months and all logins from all other locations have logged in. I also have 2step that has been removed. and then i messaged the bot got access back but my backup email is still the hackers and i can not change it so please HELP. and also my second account is also hacked. and is also getting spammed by the same messages.

My concern is that is actually hacked, i have reinstalled windows i will also do a bios flash and reinstall again with a real formater. but i have access to both accounts. but so does the hacker. and i really need urgent help with this matter !!

I've scan all devices linked with my Microsoft account and i have seen mutliple logins from a lot of places. russia, USA india etc and i need HELP fixing this. as it has stolen 4 different game hubs. EPIC GAMES, Steam and so on.

Regards

Mattias S

Answer 1

It sounds like your email accounts have indeed been compromised, and it's crucial to take immediate action to secure them. Here are steps you can follow to regain control and secure your accounts:

1. Revoke User Access: Immediately revoke access to your accounts to prevent further unauthorized access. You can do this by using PowerShell commands to revoke sign-in sessions for your Microsoft 365 accounts. For example:

      Revoke-MgUserSignInSession -UserId <your-email-address>
   

   Replace <your-email-address> with your actual email address.
2. Change Your Passwords: Change the passwords for both of your email accounts. Make sure to create strong, unique passwords that are not easily guessable.
3. Enable Multi-Factor Authentication (MFA): If you regain access, enable MFA for added security. This will help protect your accounts even if someone has your password.
4. Review Account Activity: Check your account activity for any unauthorized logins or changes. Look for suspicious activity such as changes to your recovery email or security questions.
5. Secure Your Devices: Since you mentioned reinstalling Windows, ensure that your devices are free from malware. Use reputable antivirus software to scan and clean your devices.
6. Check for Mail Forwarding or Rules: Review your email settings for any suspicious forwarding rules or filters that may have been set up by the attacker. Remove any that you did not create.
7. Contact Support: If you cannot regain access to your accounts or if the recovery email is still under the hacker's control, contact Microsoft Support for further assistance.
8. Monitor for Further Issues: Keep an eye on your accounts and any linked services (like Epic Games and Steam) for unusual activity. Change passwords for those accounts as well if you suspect they may also be compromised.

Taking these steps can help you regain control of your accounts and protect your personal information.

Answer 2

Hello,

This is not always due to spam.

Make sure you do this on a computer, not on smartphone or tablet. Go to https://www.outlook.com and log in, click on the gear icon on the top right to launch the settings.

Then, on the Mail tab, go to Rules. Are there any rules set up here? If yes, delete them all.

Then check the conditional format, again, if it's there, delete it.

Then, check Forwarding and IMAP, If any items are present, delete them as well.

===========

If you can't find anything, go to https://account.live.com > Your info > Sign in Preferences. Make sure to check all the aliases here. If you don't recognize any there, delete it.

Then go to Security > Manage How I sign in, make sure all contact info is yours.

Please make sure you change your password and enable two-step verficiation.

Go to your account online, go to Devices, remove any devices you don't recognize.

Then go to Security, click on Sign out everywhere. This is meant to kill any session that's still connected. Unfortunately, this one will take 24 hours to take effect.

Then, take one step further - Go to your Microsoft account online https://account.live.com> Sign in > Your info > Sign in preference. Add an alias - You have two options here:

Create new: this will allow you to use the native domain outlook.com to create a new alias.

Add existing: this will allow you to add a 3rd party email address, such as yahoo, gmail, as long as they are not already associated with another Microsoft account.

Once added, make this new alias your primary alias, do NOT delete the old alias. Then at the bottom, click on "Change sign in preference". On the next page, uncheck the box for the old alias. This means, from now one, the old alias cannot be used to sign into your Microsoft account, but it can be still used to receive emails, etc.