Compromised account: Persistent mailbox forwarding rules and unrevoked session after password reset

Question

My personal Microsoft account was compromised. The attacker maintained silent access by creating server-side Exchange forwarding rules to intercept incoming emails and hijack linked external accounts.

Mailbox diagnostic data confirms a rule named idtienphuoc1 forwarding mail to a burner xitroo.com address, the time zone modified to SE Asia Standard Time, and delivery errors triggered by the Mailbox Rules Agent.

I have updated my password, enabled 2FA, and clicked "Sign out everywhere", but active Exchange sessions or refresh tokens seem to persist.

I am also currently blocked by the weekly alias rate limit, so I cannot disable login on the primary alias. How can I request an immediate, forced server-side token revocation and full mailbox rule purge from Microsoft support?

Answer 1

Ciao, sono Virginia.

Verifica se sono attive delle regole di inoltro che inoltrano le email a un altro indirizzo.

Outlook via web:

Clicca sull'icona a forma di ingranaggio > Posta elettronica > Regole.

Verifica anche la presenza di regole nascoste:

Controlla i suggerimenti qui per vedere se sono presenti regole nascoste per i messaggi:

https://learn.microsoft.com/en-us/answers/questions/4727095/undeletable-inbox-rule-placed-by-a-hacker

https://learn.microsoft.com/en-us/answers/questions/5492279/someone-has-hacked-my-email-and-created-a-forwardi

https://learn.microsoft.com/en-us/answers/questions/4738494/a-draft-has-been-appearing-in-our-inbox-and-when-w

Come ultima risorsa, dovrai contattare l'assistenza:

https://learn.microsoft.com/en-us/answers/questions/5569093/my-outlook-account-was-hacked-auto-reappearing-inb Segui le istruzioni della risposta contrassegnata. Se necessario, utilizza la funzione di traduzione del tuo browser per leggere i post nella tua lingua.