Hacked email

Question

Hacked email

Roger Levi 0

My Hotmail account seems to have been hacked. Messages are all from a bot called Sky Market. I changed my password for Outlook. Not sure how to fix this problem.

0 comments

2 answers

Your answer

Answer 1

Hello,

I am going to share with you the comprehensive list of things to do, please feel free to skip those you already did.

This process can take 24 hours to take effect. So please do not expect immediate results.

Please complete these steps on a computer, not on a smartphone or tablet.

====================

First, go to https://www.outlook.com and sign in.

Click the gear icon in the top right corner to open Settings.

Under Mail, review the following areas:

Rules

If any rules are listed, delete all of them.

Conditional formatting

If anything is set up there, delete it.

Forwarding and IMAP

If you see any entries or settings you did not create, remove them. Turn off POP and IMAP.

Junk

Review Safe sender and blocked list. If you don't recognize any, remove them.

After that, exit Settings and return to outlook.com.

Open the To Do section by clicking the blue checkmark icon on the left side. Delete anything there that was not created by you.

====================

Go to https://account.live.com.

Under Your info > Sign-in preferences, review all aliases on the account. If you see any alias you do not recognize, remove it.

Next, go to the Devices section of your Microsoft account and remove any devices you do not recognize.

====================

Please also do the following in Security section

Change your password

Enable two-step verification

====================

Go here https://account.microsoft.com/privacy/app-access Click on "Don't allow" for anything you don't recognize.

=======================

Then go to Security > Manage how I sign in and make sure all contact information belongs to you.

On that same page, scroll down to App passwords and remove any existing app passwords.

Also on the same page, click on Sign out everywhere. This is intended to disconnect any active sessions that may still be connected. Please note that this can take up to 24 hours to fully take effect.

====================

In addition, this problem can sometimes be caused by a malicious script or infection on one of your devices.

Are you using a Windows computer to check email? Do you use an email app such as Outlook Classic or New Outlook?

If so, please open the app and remove the account from the app settings.

Then go to the Microsoft Safety Scanner download page:

https://learn.microsoft.com/defender-endpoint/safety-scanner-download

Download the 64-bit version, run a full scan, and let me know what the final results say.

=====================

If after 24 hours it still doesn't work, please do this:

Go to your Microsoft account online https://account.live.com> Sign in > Your info > Sign in preference. Add an alias - You have two options here:

Create new: this will allow you to use the native domain outlook.com to create a new alias.

Add existing: this will allow you to add a 3rd party email address, such as yahoo, gmail, as long as they are not already associated with another Microsoft account.

Once added, make this new alias your primary alias, do NOT delete the old alias. Then at the bottom, click on "Change sign in preference". On the next page, uncheck the box for the old alias. This means, from now one, the old alias cannot be used to sign into your Microsoft account, but it can be still used to receive emails, etc.

Answer 2

Since the password is already changed, complete the cleanup by scanning the device, removing unauthorized Outlook settings, reviewing sign-ins, signing out all sessions, and enabling two-step verification.

1. Scan the device used to access Hotmail

An infected device could expose the new password as well.

On Windows, open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now. Microsoft recommends a full malware scan when recovering a compromised account.^1^

If the password was changed before scanning, do not change it again immediately unless the scan finds malware. If it does, remove the threat first and then create another unique password from a clean device.

2. Remove changes made inside Outlook.com

Use a computer browser and sign in to Outlook.com. Then select Settings (gear) → Mail and inspect:

Rules: Delete any rule you did not create, particularly one that moves, deletes, or redirects messages.
Forwarding: Remove unknown forwarding addresses or turn forwarding off.
Automatic replies: Remove unfamiliar content.
Connected accounts: Remove anything you do not recognize.

These settings can continue redirecting or manipulating mail even after the password has changed. Microsoft’s recovery procedure specifically calls for checking connected accounts, forwarding, and automatic replies.^1^

Also inspect Sent Items, Deleted Items, and Archive. Messages in Sent Items that you did not send are stronger evidence that someone accessed the mailbox. Messages merely arriving from “Sky Market” may instead be ordinary spam or phishing.

3. Review account activity

Open the Microsoft account Security page, select Review activity, and inspect recent sign-ins. Microsoft shows recent activity for the previous 30 days, including available device or application details.^2^

For an entry that definitely was not yours:

Expand an entry under Unusual activity and select This wasn’t me.
For an unfamiliar entry under Recent activity, select Secure your account.^3^

Review the account’s security information as well. If an unknown verification method exists, add a replacement method you control before removing it. Removing all security information at once places the account into a 30-day restricted state.^4^

4. Revoke any remaining sessions

Go to the Microsoft account security dashboard’s Advanced security options, scroll to Sign out everywhere, and select Sign out. This signs the account out of browsers and applications within 24 hours, except Xbox consoles.^5^

5. Enable two-step verification

From the Microsoft account Security tab:

Select Manage how I sign in.
Under Additional security → Two-step verification, select Turn on.
Complete the prompts, preferably using Microsoft Authenticator.^6^

6. Handle the “Sky Market” messages

Do not reply, open attachments, follow links, or enter credentials.

In Outlook.com:

Select the message.
Select Report → Report phishing.
To stop further messages from that address, also add it to Blocked senders; reporting phishing alone does not block future mail.^7^

If unfamiliar sign-ins or sent messages continue after the scan, session revocation, and mailbox cleanup, use Microsoft’s compromised-account sign-in helper; it can provide self-help or offer access to an agent.^1^

References