reoccurring hacked drafts in my inbox

Question

My Outlook.com mailbox is generating drafts every few seconds even after password reset, 2FA, sign‑out everywhere, removing rules, removing devices, and clearing drafts. I need a mailbox state reset because the Drafts folder is regenerating due to a corrupted server‑side process.”

how to fix reoccurring hacked drafts in my inbox?

Answer 1

Reoccurring hacked drafts in Outlook.com are typically caused by leftover malicious rules, forwarding, connected apps, or active sessions rather than a corrupt mailbox state. To fully clean up the account, follow these steps in order:

1. Verify the account is not blocked or compromised

• If there are issues sending/receiving or unusual activity, first ensure the account is not blocked and that sign-in is working correctly.
• If sign-in problems persist, use the Microsoft account sign-in helper: Microsoft account sign-in helper.
• If the account was hacked, run through the recovery flow: How to recover a hacked or compromised Microsoft account.

2. Run a full malware scan on all devices

• Before changing anything else, scan every device used to access Outlook.com (PC, phone, tablet) with an up-to-date antivirus.
• This ensures no malware or malicious add-in keeps injecting drafts or reconnecting to the mailbox.

3. Reset password and confirm security info

• After cleaning devices, change the Microsoft account password again using the official password change/reset options.
• Review security info (phone, alternate email, authenticator) and remove anything not recognized.

4. Clean up Outlook.com mailbox configuration Sign in to Outlook.com on the web and check:

• Rules:
  • Go to Settings → Mail → Rules.
  • Delete all rules that are not explicitly created or recognized.
• Forwarding:
  • Go to Settings → Mail → Forwarding.
  • Remove any forwarding addresses that are not recognized.
• Automatic replies:
  • Go to Settings → Mail → Automatic replies.
  • Turn off any automatic replies that were not set intentionally.

These are explicitly called out as items to review after a compromise because attackers often use them to automate messages and drafts.

5. Sign out everywhere and remove device partnerships

• Use the Microsoft account security page to sign out of all sessions.
• For devices that sync Outlook.com, remove and re-add the account if drafts continue to appear only from a specific device.
• If one device is causing issues, remove its partnership as described in the Outlook.com sync guidance.

6. If drafts still regenerate, treat it as a compromised/hacked scenario

• Use the hacked/compromised account recovery guidance again to ensure no lingering access:
  • Start with the sign-in helper tool: Start.
  • Follow the flow to either self-remediate or reach an agent.

7. Contact Outlook.com support for mailbox-side investigation If drafts continue to regenerate after all the above steps, support needs to review the mailbox state on the server side:

• In Outlook.com (web), select Help on the menu bar.
• Enter the issue (for example, “reoccurring hacked drafts in Drafts folder”).
• If self-help articles do not resolve the issue, scroll down to “Still need help?” and select Yes.
• Choose the option to chat with a support agent in the web browser.

If sign-in is not possible, use the alternate Outlook.com support entry point for non-signed-in users.

Support can:

• Confirm whether there are hidden rules, processes, or account blocks.
• Escalate for deeper mailbox-side checks if needed.

If the account was clearly hacked and automated drafts are part of the attack, also report it through the hacked/compromised account flow so the case is flagged correctly.

---

References:

• How to recover a hacked or compromised Microsoft account
• Unblock my Outlook.com account
• Can't send or receive email in Outlook.com
• Fixes or workarounds for recent issues on Outlook.com
• Email stuck in Outlook.com
• My account got hacked. - Microsoft Q&A
• My personal hotmail account hacked by hacker with authentication app enabled. - Microsoft Q&A
• Need to speak to a agent I am getting pop up draft scam emails - Microsoft Q&A
• Hacker set up continuous draft ransomware email - Microsoft Q&A
• How do I send an email to Microsoft about my account being hacked and taken over by <removed> ? - Microsoft Q&A