Compromised Account - Un-Deletable Rules

Question

Today my email was compromised—some of my existing emails, and all need incoming emails were changed to a spamming message asking to send money to seize the hack. I changed my password (twice) and signed out of all devices. No new issues occurred, meaning I felt the hacker no longer had access to my account.

However, went to "Rules" in my Settings, a rule called "idtienphuoc1" is there and forwards all new emails to a random email address. I cannot delete the Rule, and beyond the initial chat in Microsoft (which just directed me to go to "Help" and "Still need Help?" (which didn't get me to anyone different), there's nothing I can do.

I desperately need help, as all incoming emails get transformed into a spam message, making them unreadable. Please, someone help me.

Answer 1

Hi Spencer Legebokoff,

I hope you are doing well ! I just want to check if you have had a chance to test the steps earlier? Please let me know if they helped resolve the issue or if you are still experiencing any difficulties. I am here to assist you further.

Best Regards

Answer 2

Hi Spencer Legebokoff,

Thanks for reaching out to the Microsoft Q&A forum. I’m sorry to hear your account was compromised. I know how stressful that can be, and I’ll do my best to help you recover it.

Please make sure you already tried the Q&A Assist steps. In addition, please do these recovery steps in order:

1, Check and remove forwarding

• Go to Settings > Mail > Forwarding
• Make sure Forwarding is OFF
• Delete any unknown forwarding address

2, Check “Inbox rules” again

• Settings > Mail > Rules
• Try deleting the suspicious rule again
• If it will not delete, move to Step 3

3, Remove all third‑party app permissions

Attackers often keep access through old app tokens even after password resets.

• Open: https://account.microsoft.com/security
• Select “Advanced security options”
• Scroll to “Apps and services you’ve given access to your account”
• Remove every app you do not recognize
• Remove anything with IMAP, SMTP, or POP permissions if you don’t use those apps

4, Sign out of all sessions (full reset)

Still in Advanced security options:

• Select “Sign me out everywhere”
• Then reset your password again using this guidance: Reset a forgotten Microsoft account password - Microsoft Support
• This will force every malicious session to close.

5, Enable MFA

• Turn on two-step verification so an attacker cannot re-enter.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".  

Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Answer 3

To address the issue of the undeletable rule in your Microsoft 365 account, follow these steps:

1. Sign in to Outlook Web: Go to the Outlook web application and log in to your account.
2. Access Rules: Navigate to Settings > Mail > Rules to check for any suspicious rules.
3. Delete Suspicious Rules: If you find the rule "idtienphuoc1" that forwards emails, try deleting it again. If it does not delete, proceed to the next steps.
4. Check for Forwarding: Go to Mail > Accounts > Forwarding and ensure there are no unknown forwarding addresses set up. Disable any forwarding if necessary.
5. Use PowerShell: If you have admin access, you can use PowerShell commands to find and delete hidden rules. Use the command Get-InboxRule -Mailbox youraddress@example.com to list all rules and delete the unwanted one.
6. Revoke App Permissions: Go to Microsoft Account Security and revoke any apps you do not recognize, as hackers may use these to maintain access.
7. Monitor Account Activity: Keep an eye on your account for any further suspicious activity and ensure you have Multi-Factor Authentication (MFA) enabled.

If these steps do not resolve the issue, consider reaching out to Microsoft Support for further assistance.

---

References:

• Respond to a compromised cloud email account
• Hacker set up continuous draft ransomware email - Microsoft Q&A