Compromised Outlook Account – Incoming Emails Being Replaced / MailFR AccessCheckrbot

My Outlook.com account was compromised. I have already changed the password, enabled 2FA, signed out all sessions, removed unknown app permissions, and checked forwarding and inbox rules. There have been no further unauthorized successful sign-ins.

However, I am still receiving highly unusual messages that appear to replace legitimate incoming emails. The sender and timestamp correspond to emails I would actually expect (for example Instagram and Accor), but the original content is replaced by advertising for “MailFR / @AccessCheckrbot”.

The message source contains the headers X-MailFR-Replace: 1 and X-MailFR-Mode: replace.

**Please investigate the server-side message trace/authentication and check whether any mailbox access, OAuth token, connector, hidden inbox rule or other persistent access remains on my Outlook.com mailbox. I can provide the full message source of affected messages.

Update:**

This happened again immediately after I contacted Microsoft Support. I was expecting an email from Microsoft, and at 10:27 I instead received another MailFR/AccessCheckrbot replacement message showing Microsoft Learn as the sender. The source again contains X-MailFR-Replace: 1 and X-MailFR-Mode: replace. Please compare the Message-ID and server-side message trace with the original Microsoft message sent to my account at 10:27 CEST.