My Account was hacked

Question

I have reset my password, added a 2-step authenticator, removed a suspicious rule and done a force log out of all devices. I spoke to a live chat agent who sent a follow-up link to live support but it was sent to the compromised email address, and its lost I cannot find the live chat option anywhere. The search help function comes up with zero help, no matter what keywords I put in.

Can anyone assist me?

Answer 1

Hello

Looks like you are already on the right path.

The sign out everywhere can take 24 hours to kick in, so it can be just a matter of time.

I am going to share with you the comprehensive list of things to do, please feel free to skip those you already did. This process can take a bit time, so please be patient as you go through it. I worked with quite a few users that managed to get this to work, but they all take time to go through. Here is an example: https://learn.microsoft.com/en-us/answers/questions/5806739/outlook-email-hacked?orderby=oldest&page=1&comment=answer-12639146&translated=false#answers

Please complete these steps on a computer, not on a smartphone or tablet.

====================

First, go to https://www.outlook.com and sign in.

Click the gear icon in the top right corner to open Settings.

Under Mail, review the following areas:

Rules

If any rules are listed, delete all of them.

Conditional formatting

If anything is set up there, delete it.

Forwarding and IMAP

If you see any entries or settings you did not create, remove them. Turn off POP and IMAP.

Junk

Review Safe sender and blocked list. If you don't recognize any, remove them.

After that, exit Settings and return to outlook.com.

Open the To Do section by clicking the blue checkmark icon on the left side. Delete anything there that was not created by you.

====================

Go to https://account.live.com.

Under Your info > Sign-in preferences, review all aliases on the account. If you see any alias you do not recognize, remove it.

Next, go to the Devices section of your Microsoft account and remove any devices you do not recognize.

====================

Please also do the following in Security section

Change your password

Enable two-step verification

====================

Then go to Security > Manage how I sign in and make sure all contact information belongs to you.

On that same page, scroll down to App passwords and remove any existing app passwords.

Also on the same page, click on Sign out everywhere. This is intended to disconnect any active sessions that may still be connected. Please note that this can take up to 24 hours to fully take effect.

====================

In addition, this problem can sometimes be caused by a malicious script or infection on one of your devices.

Are you using a Windows computer to check email? Do you use an email app such as Outlook Classic or New Outlook?

If so, please open the app and remove the account from the app settings.

Then go to the Microsoft Safety Scanner download page:

https://learn.microsoft.com/defender-endpoint/safety-scanner-download

Download the 64-bit version, run a full scan, and let me know what the final results say.

Answer 2

Take these steps to both secure the account and reach the right support paths again:

1. Verify and secure the account

• Since the account was hacked, follow Microsoft’s compromised-account guidance:
  • Change the password again to a strong, unique one (different from any used before).
  • Ensure two-step verification (MFA) is fully enabled and working on a trusted device.
  • If the account is part of Microsoft 365 (work/school), an admin should also revoke sessions using Microsoft Graph PowerShell:
    • Install and connect:

            Install-Module Microsoft.Graph.Authentication
            Install-Module Microsoft.Graph.Users.Actions
            Connect-MgGraph -Scopes User.RevokeSessions.All
      

    • Revoke sign-in sessions:

            Revoke-MgUserSignInSession -UserId <UPN>
      

  • If the account is synced from on-premises Active Directory, reset the password in AD (twice) as per guidance.
  • If the identity is federated, change the password in the on-premises environment.

2. Clean up any remaining attacker persistence

• In Outlook on the web:
  • Check Settings → Mail → Rules and delete any suspicious rules.
  • Check Mail → Forwarding and remove any unknown forwarding addresses.
• If using Microsoft 365/Exchange Online and you have admin rights, also review:
  • Mail flow rules, connectors, and add-ins that could have been added.
• Make sure app passwords (if used) are deleted and recreated, because they are not automatically revoked when you reset the password.

3. Strengthen protection going forward

• Keep MFA enforced on the account; Microsoft highly recommends MFA, especially for any admin or high-value account.
• Consider phishing-resistant MFA methods where available.
• Review Microsoft’s guidance on keeping the account secure and consider going passwordless using Microsoft Authenticator, Windows Hello, or security keys.

4. Get back to official support options Because the previous live-chat link went to the compromised mailbox, use the official self-service and support entry points again from a browser:

• For a hacked or compromised Microsoft account (including Outlook.com/Hotmail), start with the Sign-in Helper / hacked-account helper to get the right recovery and support flow.
• If sign-in or recovery fails, use the Microsoft account recovery form from a device and location normally used with the account, and provide as much accurate information as possible.
• If the recovery form or helper tools show technical errors, go through the main Account & Billing Help and Contact support flows to reach a chat agent again (these portals do not require the old chat link in email).

If the account is a free consumer Outlook.com/Hotmail account, only the automated recovery and security processes plus what support can do through those official flows can restore or further assist; there is no manual bypass of those protections.

---

References:

• Respond to a compromised cloud email account
• How to recover a hacked or compromised Microsoft account
• Help with the Microsoft account recovery form
• Hello , welcome to Account help & learning
• Phishing and suspicious behavior in Outlook
• How to help keep your Microsoft account secure