Email spoofing sending emails from my actual account

Question

Hi there, my account was compromised yesterday. I regained access, changed password, enabled 2FA and signed out all other devices. While hacked there were lots of spam emails sent from my account. I thought this was solved once I gained access and secured my account however, I woke up this morning and there were another quantityof emails sent out from my address.

I checked any rules that may have been set up (auto replies, auto forwarding etc) and there was nothing to note.

How can i stop this?

Answer 1

Hi! Sorry to hear that you have trouble with this situation. When you add the email in some email handler apps, even after you close the session on all devices, it could remain open. Please review that you have followed all these options.

First, please check your draft, as the attacker could have scheduled these emails to be sent later. If that's the case, in your draft emails, you will see a "scheduled" legend next to the emails.

Also, you should check that your contact methods remain the same here:

https://account.live.com/proofs/manage/additional

After that, close all your open sessions. You will need to log back in to all your devices, but it's safer this way:

https://account.live.com/proofs/manage/additional

After this, please review the next link to see if any apps that you don’t know have access to your account and delete them. This is important:

https://microsoft.com/consent

Finally, do this in Outlook from Edge:

Sign in to Outlook.com

Click on the gear icon (Settings) in the upper right corner.

Look for and open Mail settings.

Go to the Rules section and check if there are any rules you didn’t create. If there are any suspicious rules (for example: “forward everything to @.___” or “move everything to Deleted”), delete them immediately.

Also, check in Forwarding and IMAP again and make sure there are no addresses added. If there is one and it’s not yours, remove the forwarding.

Answer 2

It sounds like your account may still be compromised or that there are lingering issues allowing unauthorized emails to be sent from your account. Here are some steps you can take to stop this:

1. Check for Suspicious Rules Again: Even if you didn't find any initially, double-check your email rules in Outlook Web. Go to Settings → Mail → Rules and ensure there are no hidden or suspicious rules that could be forwarding or sending emails.
2. Review Forwarding Settings: Check your forwarding settings under Mail → Forwarding to ensure that no unknown addresses are set up to receive forwarded emails.
3. Inspect Account Activity: Look for any unusual account activity or login attempts. This can help identify if someone else is still accessing your account.
4. Revoke App Permissions: Go to Microsoft Account Security and revoke permissions for any apps that you do not recognize. Hackers often use these to maintain access to your account.
5. Enable Multi-Factor Authentication (MFA): Since you've already enabled 2FA, ensure that it is functioning correctly and consider using an authenticator app for added security.
6. Monitor Your Account: Keep an eye on your account for any further suspicious activity. If you notice anything unusual, take immediate action.
7. Contact Microsoft Support: If the problem persists, consider reaching out to Microsoft Support for assistance. They may have additional tools to help secure your account and stop the unauthorized emails.
8. Consider Temporary Account Disabling: If you continue to experience issues, temporarily disabling the account until you can resolve the problem may be necessary.

Following these steps should help you regain control and stop the unauthorized emails from being sent from your account.

---

References:

• Respond to a compromised cloud email account
• Secure and Restore Email Function to a Compromised Microsoft 365 Mail Enabled Account