I am getting "You have been hacked" draft messages every minute or so in my email. Help

Question

Something is creating "You have been hacked" emails in drafts every minute or so. I have changed my password, updated to MFA. Cleared rules, etc. Forced logouts but it is still happening. What do i do next.

Answer 1

Hi Pamela,

Is there anything suspicious in the Todo app? The drafts might come from there if you have access to your account.

https://to-do.office.com/tasks/

Delete everything and let me know if it works.

Answer 2

It sounds like your email account has been compromised, and the hacker may still have access to it despite your efforts to secure it. Here are some steps you can take to regain control and stop the draft messages:

1. Thorough Cleanup: Sign in to Outlook Web and check your settings. Go to Settings → Mail → Rules and delete any suspicious rules. Also, check Mail → Forwarding for any unknown forwarding addresses and remove them.
2. Sign Out Everywhere: Use the Microsoft Account Security feature to sign out of all active sessions. This can help disconnect any unauthorized access.
3. Manage App Permissions: Review the apps that have permissions to your account and revoke access to any that you do not recognize.
4. Check for Hidden Rules: If you have Microsoft 365 admin access, review the Exchange Admin Center under Mail Flow → Rules. You can also run PowerShell commands like Get-InboxRule -Mailbox youraddress@example.com to find and remove hidden rules.
5. Reset Password Again: After performing the above steps, reset your password again and ensure that Multi-Factor Authentication (MFA) is enabled.
6. Monitor Sign-in Logs: Keep an eye on your sign-in logs for any suspicious activity. This can help you identify any further unauthorized access.
7. Scan Devices: Run a full antivirus scan on all devices you used to access your email account to ensure they are not compromised.
8. Factory Reset Devices: If you suspect that a device may be compromised, consider performing a factory reset on that device.
9. Inform Contacts: If you regain access, inform your contacts about the potential compromise to prevent them from falling victim to phishing attempts.

By following these steps, you should be able to regain control of your account and stop the unwanted draft messages from being created.

---

References:

• Hacker set up continuous draft ransomware email - Microsoft Q&A
• My personal hotmail account hacked by hacker with authentication app enabled - Microsoft Q&A