Hacked Account – Emails Being Modified in Real Time by Unauthorized Access

Question

Hello Microsoft Support Team,

I am writing to report that my personal Outlook/Hotmail account ([Moderator note: PII removed]@hotmail.com) has been seriously compromised.

Here is what is happening:

• Emails I receive are having their content replaced in real time with a scam message, even after I read them normally. This happens on all devices and browsers.
• I confirmed unauthorized logins from foreign countries in my recent sign-in activity.
• I have already taken the following steps without success: • Signed out of all active sessions • Enabled two-factor authentication (2FA) • Changed my password • Deleted all inbox rules • Disabled email forwarding • Checked for connected apps (none found) • Disabled IMAP/POP access

Despite all these actions, the problem persists. The attacker appears to have backend-level access that is not visible through the normal account interface.

I believe there may be a delegated access, hidden token, or server-side configuration that only Microsoft support can identify and remove.

Please help me fully secure and recover my account as soon as possible.

Thank you,

[Moderator note: PII removed]

Answer 1

Please note that our forum is a public platform, and I modified your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data. 

---

Hi MARA ELIZ DE FÁTIMA,

Welcome to the Microsoft Q&A forum.

I’m really sorry you’re dealing with this. Seeing your emails altered in real time, especially after you’ve already taken so many protective steps, is understandably distressing and exhausting.

Based on your description, you have already completed many of the recommended security actions, including signing out of all sessions, enabling two‑factor authentication, changing your password, reviewing recent sign‑in activity, removing inbox rules, disabling forwarding, checking connected apps, and disabling POP/IMAP access. Since this behavior continues despite those actions and occurs across devices and browsers, further investigation is needed.

To clarify expectations, contributors on this forum do not have access to Microsoft’s internal account or server‑side security systems. When an issue persists after all visible account settings have been reviewed, it needs to be handled by Microsoft Support so further investigation can be performed.

Please follow the steps below to reach an agent via live chat:

1, Visit the Microsoft Support contact page: Contact - Microsoft Support  

2, In the search bar provided on the page, type "Account recovery" and press Enter.  

3, Click on the "Get Help" button that appears.  

4, Scroll down the page until you see and click on the "Contact Support" option.  

5, When prompted to select your product or service, choose "Other Products".  

6, For the category, choose "Manage account security".  

7, Look for and click on "Chat with a support agent in your web browser".  

8, Confirm your personal email when prompted - this is the email Microsoft will use to communicate with you during and after the support session.  

9, When connected, clearly explain your situation. Be concise but include all relevant details.  

I hope this helps move things forward and that Microsoft Support can work with you to fully secure the account.