Compromised Outlook account; recurring malicious draft suggests server‑side corruption.

Question

My Outlook.com/Hotmail account was compromised (saw US IP sign-ins). I've secured it: changed password, enabled 2FA with Authenticator, signed out everywhere multiple times, deleted all rules (none left), revoked all app permissions, emptied Deleted/Recoverable Items. A sextortion blackmail draft (RAT/Trojan text demanding Bitcoin) keeps reappearing in Drafts after deletion. Apple support confirmed 1000+ folders flooding causing sync issues in Apple Mail. Please check server-side for hidden rules, scripts, BHMailer, mailbox corruption, or artifacts recreating the draft, and run a repair/reindex. No visible rules/apps left.

Answer 1

This problem has been reported by many users. A sample of some of the Q&A post:

https://learn.microsoft.com/en-us/answers/questions/5785494/all-my-emails-are-changed-to-threaten-email-and-i

https://learn.microsoft.com/en-us/answers/questions/5786650/email-hacked-new-emails-get-turned-into-spam-black

https://learn.microsoft.com/en-us/answers/questions/5783554/emails-overwritten-by-scam-email-(draft)-scam-emai

You can scan thru these for any steps you have not already taken. But if the root cause is a "Hidden Rule" you will probably want Microsoft Support to do the cleanup directly on your outlook.com account tenant.

Outlook Mobile In App Support
https://support.microsoft.com/en-us/office/get-in-app-help-for-outlook-for-ios-and-android-218a22d1-9fa5-4889-b689-de1c63493243

MS 365 - Subscriber Support
https://www.microsoft.com/en-us/microsoft-365/support

All others
https://support.microsoft.com/home/contact

Answer 2

The recurring sextortion draft and massive folder creation are strong indicators that the account is still affected by a compromise mechanism on the service side (hidden rules, malicious forms, or similar artifacts), even after visible rules and app permissions were removed.

Because all client‑side steps were already taken (password change, 2FA, sign‑out everywhere, app permission revocation, rule cleanup, Deleted/Recoverable Items cleanup), the next actions need to focus on:

1. Treating this as an active compromise and following Microsoft’s official remediation flow.
2. Specifically checking for hidden or non‑obvious mailbox rules and Outlook form–based attacks.
3. Ensuring all sessions and MFA methods are clean.

Actionable steps based on Microsoft guidance:

1. Verify and continue securing the account as compromised
   • Follow the official “recover a hacked or compromised Microsoft account” steps:
     • Run a full malware/antivirus scan on every device that has accessed this account recently, and only then change the password again to a new, unique, strong password.
     • Confirm 2FA is enabled and functioning and that sign‑in attempts from unknown locations are blocked.
   • This ensures no local RAT/Trojan is re‑injecting content into the mailbox after it syncs.
2. Check recent activity and sign‑ins
   • Use the Recent activity page (https://account.live.com/Activity) to review sign‑ins, locations, IPs, and app/device details.
   • If any unfamiliar activity appears after the last password/2FA change, treat it as ongoing compromise and repeat the secure‑device + password‑reset cycle.
3. Re‑check server‑side account settings (consumer Outlook.com)
   • After regaining stable access, verify:
     • Connected accounts
     • Forwarding
     • Automatic replies
   • These are explicitly called out as settings attackers may alter and that are reset or must be reviewed after compromise.
4. Investigate for hidden Outlook rules and custom forms (persistence)
   • The behavior (drafts reappearing, large‑scale folder creation) matches known Outlook Rules and Custom Forms injection attacks, where:
     • Malicious rules or custom forms trigger when specific messages arrive.
     • These can be largely invisible to normal users and can re‑create content even after manual cleanup.
   • Indicators include:
     • Rules whose action is to start an application or reference an EXE/ZIP/URL.
     • Custom forms stored in Personal Forms Library or Inbox with message class like IPM.Note.[custom name] containing executable code.
   • Microsoft’s guidance for such attacks is to detect and remediate these rules/forms specifically, not just normal inbox rules.
5. If using Microsoft 365/Exchange Online (work/school scenario)
   • Admins can:
     • Use Get-InboxRule -Identity "<user>" -IncludeHidden | Format-List in Exchange Online PowerShell to surface hidden rules that do not appear in the normal UI.
     • Review and remove any forwarding or suspicious rules and verify no SMTP forwarding is configured with Get-Mailbox -Identity <Identity> | Format-List Forwarding*Address,DeliverTo*.
   • For a pure Outlook.com/Hotmail consumer account, these exact PowerShell commands are not available, but the pattern shows that hidden rules are a known persistence vector that must be explicitly checked by the service.
6. Revoke all sign‑in sessions again at the identity level
   • Use the “sign out everywhere”/session revocation feature for the Microsoft account so any lingering sessions that might be re‑creating drafts are invalidated.
   • In Microsoft Entra–backed scenarios, the equivalent is Revoke-MgUserSignInSession -UserId <user> to force re‑authentication across all clients.
7. Review MFA devices and app consents again
   • Confirm only expected MFA methods and devices are registered; remove any unknown methods.
   • Re‑check application permissions/consents and revoke anything not recognized.
8. If the behavior continues
   • At that point, the situation matches Microsoft’s documented pattern of a mailbox that remains compromised or corrupted despite user‑visible cleanup.
   • The next step is to escalate through official Microsoft support channels (consumer Outlook.com support) and explicitly reference:
     • Ongoing compromise symptoms (recurring sextortion draft, auto‑created folders).
     • That all documented self‑service remediation steps have been completed.
     • The possibility of an Outlook Rules/Custom Forms injection or other hidden server‑side artifact that requires backend cleanup/repair.

This combination—device cleanup, account hardening, recent‑activity review, and explicit investigation for hidden rules/custom forms—is the Microsoft‑documented path to stop persistent, automatically re‑created malicious drafts and restore a compromised mailbox to a clean state.

---

References:

• Respond to a compromised cloud email account
• Detect and Remediate Outlook Rules and Custom Forms Injections Attacks
• Email is missing from your Outlook.com inbox
• How to recover a hacked or compromised Microsoft account
• Help protect your Outlook.com email account
• Hacker set up continuous draft ransomware email - Microsoft Q&A
• My personal hotmail account hacked by hacker with authentication app enabled. - Microsoft Q&A
• I have seen great advice for deleting the idtienphuoc1 Rule but none for stopping it from re-adding itself - Microsoft Q&A
• hello my email was (Moderator note: PII removed)@icloud.com and now its (Moderator note: PII removed)@jerkoffmail.com can please someone help me and the team change it my username in xbox is (Moderator note: PII removed) please help me team and change it - Microsoft Q&A