Hey there! Nice to meet you!
I'm sorry you are experiencing this.
Based on your description, the hacker may have enabled a new two-factor authentication (2FA), and the new 25-character recovery codes are now only available to him.
Since the security info has been replaced by the hacker and the 2FA has been enabled, I'm afraid there is no other working method to recover the Microsoft account, and Microsoft Support cannot help either.
Thank you for your understanding.
Best regards,
Darhyl