Hacked Outlook.com account — attacker's OAuth token still creating drafts every 90 seconds after full remediation

Question

Hacked Outlook.com account — attacker's OAuth token still creating drafts every 90 seconds after full remediation

George 20

My personal Outlook.com account (Hotmail) was compromised. Here's what happened and what I've done:

What happened:

My display name was changed to a random string ( {email name} - {leaked password} )
My mailbox language was changed to Vietnamese
131 spam/dating emails were sent from my account to random Gmail addresses
A sextortion scam draft keeps being auto-created every ~90 seconds via the Graph API (POST /me/messages), moved to my inbox, and pinned there
The attack started after an unauthorized app (Thunderbird) was linked on its own a few hours ago to my account — likely using credentials from a data breach

What I've already done (all of it):

Changed my password
Enabled 2-step verification (was already on)
Revoked all authorized app permissions
Signed out of all sessions everywhere
Disabled IMAP and POP access
Removed all connected apps (Thunderbird, etc.)
Scanned my PC — clean, no malware
Changed language back to my native language
Verified no inbox rules, no forwarding, no auto-replies

The problem that remains:

Despite all the above, the attacker's OAuth refresh token is still active. Every ~90 seconds, a new sextortion draft is created via the Microsoft Graph API (POST /me/messages) and moved to my inbox. Since i am a software developer myself, I've confirmed through the Graph API that there are NO hidden rules, NO MAPI rules, NO Folder Associated Items — it's 100% an external bot using a stolen refresh token. That's my final assumption but i need the confirmation and investigation in your end too.

I've built a monitoring script that auto-deletes these drafts every minute, but the token is still not revoked after several hours.

What I need from Microsoft:

Please force-revoke ALL outstanding OAuth refresh tokens for my account immediately. The standard revocation propagation (up to 24 hours) is too slow — the attacker is actively abusing the token right now.

Thank you.

0 σχόλια

Απάντηση αποδεκτή από τον συντάκτη ερώτησης

0 πρόσθετες απαντήσεις

Η απάντησή σας

Answer 1

Disclaimer: I noticed this thread was posted in the Greek region, but the question is written in English. Following our forum policy, I am responding in English to match the language of your query. If you prefer to view this response in Greek, please feel free to let me know.

Hello George,

Welcome to the Microsoft Q&A forum.

Thank you for clearly outlining what happened and the remediation steps you’ve already completed. Based on your description, you’ve exhausted the available self‑help options for a personal Outlook.com account, including password changes, 2‑step verification, revoking app access, disabling legacy protocols, and verifying there are no inbox rules or forwarding in place.

To clarify scope: this is a user‑to‑user support forum, and contributors here do not have access to Microsoft’s backend identity systems. Forum agents cannot inspect or forcibly revoke OAuth refresh tokens, investigate Microsoft Graph activity, or override token‑revocation propagation.

Since the unwanted activity is continuing after full remediation and appears to involve an OAuth refresh token still being honored server‑side, the next step is to contact Microsoft Support directly so the account can be reviewed by the account security/identity team.

Please follow below steps to reach a live chat agent:
1, Visit the Microsoft Support contact page: Contact - Microsoft Support

2, In the search bar provided on the page, type "Account security" and press Enter.

3, Click on the "Get Help" button that appears.

4, Scroll down the page until you see and click on the "Contact Support" option.

Εικόνα χρήστη

5, When prompted to select your product or service, choose "Other Products".

6, For the category, choose "Manage account security".

Εικόνα χρήστη

7, Look for and click on "Chat with a support agent in your web browser".

Εικόνα χρήστη

8, Confirm your personal email when prompted - this is the email Microsoft will use to communicate with you during and after the support session.

Εικόνα χρήστη

9, When connected, clearly explain your situation. Be concise but include all relevant details

I hope this helps point you to the correct escalation path for resolving the remaining activity.