How to get a backend mailbox token and session reset after being hacked.

Question

My Outlook.com account has a persistent malicious inbox rule that recreates itself instantly after password changes, sign-out everywhere, forwarding disabled, POP/IMAP disabled, no app passwords, and no connected apps. I need a backend mailbox token and session reset. I chatted with the microsoft team and they said they could not assist. The direction they provided was to check the community; however, the community can't do what is needed.

Answer 1

Hi Jeff Fortner,

Thank you for reaching out to Microsoft Q&A forum.

I understand that what you are facing right now is truly inconveniece, as the mailbox rule keeps reappearing even after you delete it.

Q&A Assist has already stated some steps that can be helpful for you, please kindly try the steps above first.

If the issue still occurs, please kindly submit your feedback via Microsoft Feedback Portal so the development team can collect this and have a further look into this issue.

Please note that this is a user-to-user support forum. Moderators, contributors including external Microsoft employees cannot directly intervene in Microsoft product features or access back-end systems. Our role is limited to providing technical guidance on reported issues, requests, or ideas only.

Thank you so much for your understanding

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Answer 2

To address the issue of a persistent malicious inbox rule in your Outlook.com account, follow these steps:

1. Thorough Cleanup: Sign in to Outlook on the web and check the settings for any suspicious rules. Navigate to Settings → Mail → Rules and delete any unknown or malicious rules.
2. Check Forwarding Settings: Ensure that there are no unknown forwarding addresses set up. Go to Mail → Forwarding and disable any forwarding that you did not set up.
3. Sign Out Everywhere: Use the option to sign out of all sessions. This can help terminate any active sessions that may be used by the hacker.
4. Review App Permissions: Go to Microsoft Account Security and revoke permissions for any apps you do not recognize, as these can be used to maintain access to your account.
5. Monitor for Hidden Rules: If you have Microsoft 365 admin access, review the Exchange Admin Center under Mail Flow → Rules. You can also run PowerShell commands like Get-InboxRule -Mailbox youraddress@example.com to find and remove hidden rules.
6. Enable Multi-Factor Authentication (MFA): If not already enabled, set up MFA to add an extra layer of security to your account. This can help prevent unauthorized access in the future.
7. Contact Microsoft Support Again: If the problem persists, consider reaching out to Microsoft Support again and explain the steps you've taken. They may have additional tools or methods to assist you further.

Unfortunately, obtaining a backend mailbox token or performing a session reset is typically not something that can be done by users directly, and it may require intervention from Microsoft support.

---

References:

• Respond to a compromised cloud email account
• Troubleshoot sign-in issues and account access problems