Email hacked, new emails get turned into spam "blackmail"

Question

My email got hacked and they got access to it and another email They changed a couple of settings but I've "secure" it, set up two factor, logged out accounts changed passwords etc. I get a new draft email every minute thats the same flagged spam blackmail, and when i try to do forget password on associated websites with that email the email i get turns into the same blackmail email as the drafts. I've tried contacting outlook but it's literally impossible with them and i've tried the changing primary email domain for it to stop and it hasn't. Anyone know of a fix or explanation? I've also obviousy gone to settings changed the forwarding settings and all of that. Sometimes i see n Email saying recovery email sent to_______ failed and its the scammers emailed. That email is no where in my settings though. Also to note this is only happening on one of the hacked emails

Answer 1

Hi! You mention that you have already done some of the steps, however, please try the process again please in this orders, first change the password, You should also check that your contact methods remain the same here:

https://account.live.com/proofs/manage/additional

After that, close all your open sessions. You will need to log back in to all your devices, but it's safer this way:

https://account.live.com/proofs/manage/additional

After this, please review the next link to see if any apps that you don’t know have access to your account and delete them:

https://microsoft.com/consent

Finally, do this in Outlook from Edge:

Sign in to Outlook.com

Click on the gear icon (Settings) in the upper right corner.

Look for and open Mail settings.

Go to the Rules section and check if there are any rules you didn’t create. If there are any suspicious rules (for example: “forward everything to @.___” or “move everything to Deleted”), delete them immediately.

Also check in Forwarding and IMAP and make sure there are no addresses added. If there is one and it’s not yours, remove the forwarding.

Answer 2

@smk vnm said

I went through all these steps ... any solutions?

@Luke posted in

https://learn.microsoft.com/en-us/answers/questions/5783554/emails-overwritten-by-scam-email-(draft)-scam-emai

that, in addition to all the other remediations that have been proposed, they also used Classic Outlook with the /cleanrules command line switch to remove any "hidden rules".

i.e. That there is a Rule (on your email server) that is partially to blame and it can not be removed using the New Outlook App, Outlook Web, or PowerShell. I can't test because I don't have an infected email account.

If you do not have access to Classic Outlook, all I can suggest is that you contact Microsoft Support and see if they can examine your tenant on the mail server and clear any Rules that might be hidden from normal Outlook clients.

You must have a working Microsoft email account to use Chat or any other Support Services. If you can not logon with your current account, create a new, temporary one at https://signup.live.com

MS 365 Subscriber Support
https://www.microsoft.com/en-us/microsoft-365/support

All others
https://support.microsoft.com/home/contact

Chat Support

• Open a browser to https://support.microsoft.com/en-us/home/contact
• Tell us your problem: ""Account hacked or compromised"
• [Get Help] {Scroll down to the bottom of the page} [Sign in to Contact Support]
• Sign in with any Microsoft account
• Products and services: "Microsoft 365 and Office"
• Category: "Outlook"
• [Confirm]
• Choose a support option -> "Chat with a support agent in your web browser"

Please advise if you want more details on Hidden Rules and how they are created.