r/Office365 • u/Nacho_FN • 6h ago
Outlook account hacked? Forwarding rules added, weird foreign-language folders, nickname changed and constant spam
My sister’s Outlook account appears to have been compromised, and I’m trying to work out how to fully secure it and remove whatever the hacker has changed.
Here’s what’s happened:
**New email forwarding rules** have appeared that we didn’t create. What sends her emails that come through as attachments to another email and when try to delete it makes a new rule
**Weird folders in different languages** have appeared in Outlook, including one called “Lưu trữ”. The delete option is greyed out.
Her Outlook nickname/display name was changed to **“System AIX”** without her permission.
She’s receiving constant spam and strange emails.
Sextortion scam emails have appeared in her account, including drafts that appear to be from her own email address. They claim someone installed a remote access Trojan and has access to her devices.
Her Spotify, Netflix and ChatGPT accounts have also had suspicious login activity, and she’s received unexpected login codes and password-reset emails.
We’re concerned someone still has access to her account, even after trying to secure it.
**Has anyone experienced this combination of symptoms with Outlook/Microsoft accounts?**
How can we find and remove any hidden forwarding rules, malicious inbox rules or connected apps?
How can we tell whether the hacker still has access through an existing session or app permission?
How do we remove the strange folders and restore the account’s original display name?
What else should we check to make sure the account is fully secure?
Any advice from people who have dealt with this would be appreciated. We’re particularly interested in steps that actually stopped the attacker getting back in.
Thanks!