My account have been compromised / hacked, I am able to log in but I am blocked to see messages.

Question

My account had recently been showing activities for the past few weeks which I was not aware of. Hacker are able to access and logged in into my email to send me a drafted email. It also took the step to change my email titles to my password (in red). While I can still log in into my account, I am not able to see some of the email as it has been blocked by a notification from the hacker.

For this, I have took the action to:

1. Change my password.
2. logged out of all devices except my main phone.

I am currently still not able to change my title name as it has been blocked, kindly guide us how to remove my title.

Answer 1

Hi, I'm John!

About the persistent draft being credited:

If you haven't tried anything yet, please start by running a full antivirus scan on your computer using Windows Security and any third-party antivirus software you have.

Run a full deep scan using a trusted security tool:

• Download and run Microsoft Safety Scanner here: https://learn.microsoft.com/defender-endpoint/safety-scanner-download
• After running the scan, please restart your PC and monitor whether the issue continues.

---

To be safe, I recommend the following steps:

Check your account rules and forwarding settings, hackers create rules that automatically forward or delete emails. You can do this in Outlook settings under Mail > Rules and Forwarding. https://support.microsoft.com/office/manage-email-messages-by-using-rules-in-outlook-c24f5dea-9465-4df4-ad17-a50704d66c59

Just to be safe, I’d recommend to sign out everywhere. Visit: https://account.live.com/proofs/manage/additional Scroll down to Sign me out and select "Sign me out".

• After signing out everywhere, please monitor if the issue persists in the coming hours.

---

"How to help keep your Microsoft account secure" https://support.microsoft.com/account-billing/how-to-help-keep-your-microsoft-account-secure-628538c2-7006-33bb-5ef4-c917657362b9

---

I really hope this information is helpful! Let me know if you have any further questions or concerns.

Regards,

John J.D.

Answer 2

Follow these steps to secure the account and remove the hacker’s changes:

1. Clean all devices
   • On every PC/phone used to access this account, run a full antivirus/malware scan and install all OS updates. This prevents the attacker from re‑capturing the new password.
   • On Windows 10/11, ensure Microsoft Defender is enabled and run a full scan as described in the hacked-account guide.
2. Secure the Microsoft account
   • Go to the Microsoft account Security basics page and change the password again to a strong, unique one (not used anywhere else).
   • Turn on two-step verification (for example with Microsoft Authenticator) and add alternate email and phone as security info so recovery is easier in the future.
   • On the Security page, review Recent activity and mark any sign-ins that are not recognized as “This wasn’t me” or “Secure your account” so Microsoft can help protect it.
3. Check Outlook.com for compromise artifacts
   • Sign in to Outlook on the web.
   • Open Settings → Mail → Rules and delete any suspicious rules (for example rules that move mail to Junk/Notes/RSS or forward to unknown addresses). Attackers often use these to hide or manipulate messages.
   • Go to Mail → Forwarding and remove any forwarding address that is not recognized.
   • Check automatic replies and signatures for any text the attacker added and remove it.
4. Fix the changed “title”/display name and subjects
   • If the attacker changed the account display name (what appears in “From”), change it in Outlook.com account settings. Once updated, new messages will use the corrected name.
   • For existing messages whose subjects were edited to show the password, manually rename those subjects or move them to another folder if they are disturbing but still needed. If they are malicious or spam, delete them.
   • If drafts or messages keep reappearing, re-check rules, add-ins, and any connected apps and revoke anything not recognized.
5. If sending is blocked or suspicious behavior continues
   • If the mailbox becomes blocked from sending, follow the Outlook.com unblock flow using the Sign-in Helper.
   • If there are still signs of compromise (new suspicious rules, drafts, or sign-ins), repeat malware scans, reset the password again, and sign out of all sessions from the Microsoft account security page.
6. Ongoing protection
   • Regularly review Recent activity for unusual sign-ins.
   • Keep antivirus and Windows updates enabled and automatic.
   • Be cautious with links/attachments and watch Outlook.com’s yellow/red safety bars and trusted sender indicators to avoid future phishing.

---

References:

• How to recover a hacked or compromised Microsoft account
• Unblock my Outlook.com account
• Respond to a compromised cloud email account
• Help protect your Outlook.com email account
• What happens if there's an unusual sign-in to your account
• Hacker set up continuous draft ransomware email - Microsoft Q&A
• My personal hotmail account hacked by hacker with authentication app enabled. - Microsoft Q&A
• Cannot Access Microsoft Account After Hacker Changed Email, Advice Needed - Microsoft Q&A
• hello my email was (Moderator note: PII removed)@icloud.com and now its (Moderator note: PII removed)@jerkoffmail.com can please someone help me and the team change it my username in xbox is (Moderator note: PII removed) please help me team and change it - Microsoft Q&A
• Why can't I log in to my Outlook account? - Microsoft Q&A