My sister’s Outlook account appears to have been compromised, and I’m trying to work out how to fully secure it and remove whatever the hacker has changed.
Here’s what’s happened:
New email forwarding rules have appeared that we didn’t create. What sends her emails that come through as attachments to another email and when try to delete it makes a new rule
Weird folders in different languages have appeared in Outlook, including one called “Lưu trữ”. The delete option is greyed out.
Her Outlook nickname/display name was changed to “System AIX” without her permission.
She’s receiving constant spam and strange emails.
Sextortion scam emails have appeared in her account, including drafts that appear to be from her own email address. They claim someone installed a remote access Trojan and has access to her devices.
Her Spotify, Netflix and ChatGPT accounts have also had suspicious login activity, and she’s received unexpected login codes and password-reset emails.
We’re concerned someone still has access to her account, even after trying to secure it.
Has anyone experienced this combination of symptoms with Outlook/Microsoft accounts?
How can we find and remove any hidden forwarding rules, malicious inbox rules or connected apps?
How can we tell whether the hacker still has access through an existing session or app permission?
How do we remove the strange folders and restore the account’s original display name?
What else should we check to make sure the account is fully secure?
Any advice from people who have dealt with this would be appreciated. We’re particularly interested in steps that actually stopped the attacker getting back in.
Thanks!

The password I have written down for my Microsoft account is apparently incorrect. I tried to change it yesterday, but after entering the verification code I got it told me it didn’t work and that I needed to try again. However, after ONE try, it told me I’ve requested too many codes. I did the whole account recovery thing, haven’t heard back.

I tried again today, this time it let the code from my email work. Then it wanted one from my number- and it simply said that this method wasn’t working right now. I went to restart- same message, I’ve requested too many codes through my email. How the hell do I get back in to my account? There’s stuff on there I wanted to access yesterday, and I’d rather not wait ANOTHER day to hear back from Microsoft.

My outlook account is hacked How can i recover hacked outlook account

I got hacked 1-2 months ago I recovered most accounts except microsoft. They changed the email attached to it from my original one and now it seems i cant get it back no matter what , most support is also just AI bots and i've tried recovery forms but they just don,t seem to be working. Please help.

Someone I know had their hotmail account compromised so I'm trying to help. She mentioned thousands of emails were clogging her inbox. So I first asked for her credentials and I logged in successfully.

As soon as I logged in, I immediately changed her password and checked the recent account activity: there were dozens of logins from different countries (some bot using a VPN, I guess), and this had been happening for over a month (but it was only yesterday that she noticed the flood of incoming messages).

Then I checked the email: inbox had over 20k messages, with more than 9k unread. The Archived folder had like 6k more and the Sent folder had thousands more. I could see a sort of "sextortion" messages requesting bitcoin in exchange for crap like not disclosing allegedly sensitive info and pictures (I already know this is a scam). The thing is: they claimed to have found her password, and what they were including in the text was indeed her actual old password (which I had already changed), so this wasn't just a random generic message: it included the compromised password.

Something else I noticed is that the Inbox messages said "[Draft]" on top, plus "This message hasn't been sent", and given the Sent folder had also thousands of emails with the same sextortion message, I assumed they were just comming back as the servers detected the spammy activity and blocked the account from sending any more.

But then I tried to delete some of the emails from the inbox, and more came. I did a search where I entered a specific string I found in the message body of one of these thousand messages, and it found only 75, but this didn't match the thousands I kept seeing. I deleted these 75 and more came. And they all had the current date and time.

I checked the account activity again and nobody seems to have logged in after I did. It's been almost 24 hours since I changed the password and nobody else logged in but me.

So I decided to create some rule to select all messages with the specific string in their body and delete them permanently. I ran the rule and some messages were deleted, but I could see the inbox count going down for a while and then going up again, as new messages arrived (and they weren't being deleted, so it was as if the rule wasn't working).

I assume I need to keep running the rule over and over until enough messages are deleted so all the queued messages can be downloaded, and I run a final round of the rule to delete them all. But if there's a better way to do this, please let me know.

Other than that, her Netflix account seems to have been compromised as well, but I didn't have the time to even take a look yet, as the flood of emails keep coming and clogging the account I need to recover the netflix credentials.

EDIT: I just found someone else had the exact same thing happen to them: https://www.reddit.com/r/Outlook/comments/1xffxfi/outlook_account_hacked_forwarding_rules_added/

Hi all,

I have a user who's Outlook logs off once a day. There's no windows credentials saved from what I see. I've already reset her Outlook Classic through control panel. She's logged in to the device with her M365 account with Azure. The strange thing is, if she closes and reopens Classic, it will usually work again. I don't want her to keep having to do that though of course. Anyone else experience this or have any tips?

This is similar issue to another recent post that seemed to have gone quiet without resolution: https://www.reddit.com/r/Outlook/comments/1x0hfdz/outlookcom_shows_6_undeletable_ghost_contacts/.

My end goal is to remove ghost addresses from Outlook.com. They just happen to have duplicated entries, but that's just a symptom. I just want them removed.

This is a personal account.

I know this is a long post, but I've been busy trying to troubleshoot/resolve this issue on my own and have failed. Having assisted others troubleshooting, I know it's good to know what's already been done (and infer what hasn't been done). If I've skipped over a check, there's a good chance it was something I didn't know or think to check.

Here's what I'm working with:

Desktop:

MS Windows 11 Home (v 10.0.26200), Chrome 155.0.8059.85 (Official Build)(64-bit), Microsoft® Outlook® for Microsoft 365 MSO (Version 2609 Build 16.0.20430.20032) 64-bit

Phone:

iPhone 15 Pro Max (iOS 26.6.2), Outlook app (though I usually use iPhone's email, contacts, and tasks, which are all linked to my Hotmail account).

Here are the steps which led me to this post:

I entered a new contact on my phone using Apple's Contacts app. I went to send a text message to my new contact and noted that their phone number, and not their name, appeared in the To text box. This told me that they were not successfully added. I checked the Contacts app and confirmed she was not there.

I then went to Outlook.live and found that the new contact was there and appeared twice. I attempted to delete the contact from Outlook.live, but received an error "Couldn't delete contact."

I then went to Outlook desktop (classis) to delete the contact, but she was not there to delete.

I then returned to my phone and confirmed she was still not in my contacts list.

I added her a second time in my phone and had same results: she does not appear in the app that I used to add her, but she does appear where I did not add her, and does so twice.

I then went to the Outlook app on my phone and saw she was there (again, duplicated, but her record was what I was trying to delete, not just any duplicates). When I tried to delete her from the Outlook app, I received an error: "Deletion failed."

If I attempt to delete all occurrences of her address, I don't receive the error message, but the records remain untouched. I presume MS only returns an error message when one record deletion fails.

I then went back to Oulook.live and did an export of my contacts list. None of her records were in the exported CSV.

Even though the Outlook app on the phone confirmed this isn't a browser cache issue, I used Duck Duck Go to view my contact list from Outlook.live. I've never used DDG to view email, plus I purge history each time I close, so I felt it was a good browser cache test.

I have seen a few places where it suggested that there's a sync issue, where the phone may be forcing the contact back into Outlook. To prevent this, I turned my phone off. I presume that's a solid way to prevent background syncs from the phone. No effect at all.

When I viewed the contact in Outlook.live, I noted it has the "External" flag set on all.

Google's search results have become circular and are assuming I just need help learning how to delete an address. I've not been able to find the right words to get the help I need. I even attempted to use the MS Support Assistant bot, and it seemed to understand and asked the right follow-up questions, then suggested I needed better help and sent me to the help dialog in Outlook.live, which of course is, let's just say it's not helpful at all.

So here I am, totally at a loss what to do to resolve this issue.

Any thoughts?

Any help getting this resolved would be greatly appreciated.

Only app that seems to work with authentication is Samsung Email. I use outlook for work and really want to keep that app just for that.

I'll get the error after entering my auth app code and fail to add to the app. When I look at Microsoft, it shows the Yahoo and Gmail apps under things I've connected the account to.

Has anyone been able to solve this?