Malicious Draft Email keeps appearing

Question

Malicious Draft Email keeps appearing

FRANKIE 20

My Outlook mailbox is continuously auto-generating scam drafts even after password reset, 2FA enabled, rules removed, forwarding disabled, POP/IMAP disabled, and all devices signed out. Sending is blocked due to daily limit. The drafts keep returning. I need a full mailbox backend reset

Ehren Smith 0 Reputation points

2026-02-13T10:14:07.4766667+00:00

HIi Winnie - same issue my side. Have deleyed all app permissions and still getting the fake draft email.
Anonymous

2026-02-15T06:33:09.25+00:00
Hi Ehren Smith

Thanks for your comment. Please make sure you have already tried all the steps mentioned above.

Please sign out of all your devices and change your account password by following these guidance:

How to sign out of your Microsoft account everywhere - Microsoft Support

Change your Microsoft account password - Microsoft Support

After that, delete all emails in your Junk folder.

Also, please go to Outlook Web (https://outlook.live.com) and check Settings > Mail > Forwarding and Settings > Mail > Rules to see if there are any suspicious actions configured.

Thank you for your understanding.
Edoardo Strinati 5 Reputation points

2026-02-15T09:54:28.6533333+00:00
Hi Winnie, I've had the same issue for the last 2 days. Scam draft email appearing in my Drafts folder and then appearning in my Inbox.

I've done every passage written here multiple times.

Changed password

activated 2FA

removed all connected apps

checked login history (after i've changed password I was the only one loggin in, so that's good)

disconnected all devices

deleted all rules

disabled Forwarding

disabled POP

disabled IMAP

As I said, I've done all of this multiple times waiting few hours between attempts to let everything disconnect correctly.

The scam email still appears.

Moreover, tonight a lot of scam emails were sent by my account at 4:40 AM.

I really need to find a solution or to reset the account.

Thank you.
Anonymous

2026-02-18T07:19:06.26+00:00

Hi Edoardo Strinati

Thank you for your comment. Please try going to Outlook on the web via https://outlook.live.com and check your To Do tab to see if there is anything suspicious. If nothing is there, please carefully scan your devices with an antivirus. Finally, from a clean device, change your email password.

Thanks for your understanding.
Zoe Fachikh 0 Reputation points

2026-02-18T14:20:15.2+00:00

I have the exact same issue.

The draft keeps coming in my inbox, I delete it, and it comes back with the new time.
It says my name and email, and my old password. It also says it has photos and videos of me. I want it gone. I've deleted it 1000000 times. I have changed my password, logged out everywhere, checked for any rules etc... the same as the people above have done. I have done it all.

I also chatted to Microsoft who were so rude and would not help me. My limit was reached, and I could not chat with them anymore.

This is how the draft email started.

Hey,

What happened here?

About a few months ago, I gained access to your devices and started tracking your online activity. I was able to hack into your computer and access your email: . Your password was easily compromised.
Anonymous

2026-02-19T07:21:18.19+00:00
Hi Zoe Fachikh

Thank you for reaching out to the Microsoft Q&A Forum. Please try contacting Microsoft Support team directly:

Go to Contact - Microsoft Support

Type a brief description of your issue in the search box.

Click "Get Help", then scroll to the bottom and select "Contact Support”.

Choose the appropriate categories.

It may offer live chat and, depending on your subscription/region, an option to request a callback: Look for and select "Chat with a support agent in your web browser" (during business hours) or a similar callback option (if available). Explain your situation clearly.

If you have already contacted them and received an unsatisfactory response, please try reaching out again. Providing a clear description of your issue and your previous Case ID will help the agent support you more effectively.

Thank you so much for your understanding!
ray bell 0 Reputation points

2026-05-09T10:44:22.4833333+00:00

I have am also having the same issues, I have followed all of the steps above and it has not resolved the issue, I am still getting thousands of draft emails a minute. I managed to speak to someone from Microsoft yesterday who confirmed my account was safe but said I needed to speak to an advisor directly in outlook, which is not possible for me. Is there anyway to resolve this without creating a completely new email address? I have even tried to remove the hackers domain from my safe sender list into blocked list and its keeps reverting back
ray bell 0 Reputation points

2026-05-09T10:46:10.4233333+00:00

Did you manage to get this resolved?
Lea Hanrahan 0 Reputation points

2026-05-10T03:15:21.7266667+00:00

Im having the same issue at the moment - cant get onto anyone from support and done all of the above steps. the emails wont stop
Hornblower409 16,820 Reputation points

2026-05-11T15:16:43.36+00:00
@ray bell and @Lea Hanrahan

You need to start a new thread using the "Ask a question" button at the top of this page to create a new Question and include the details for your specific problem. This provides much higher visibility to your issue than commenting on an old post, which is only seen by people who are already following this question.

(You can put the link for this page in your new Question for reference)

If you need Microsoft Support:

You must have a working Microsoft email account to use Chat or any other Support Services. If you can not logon with your current account, create a new, temporary one at https://signup.live.com (Once you are in Chat you can tell them the actual account with the problem).

Chat Support:

Open a browser to https://support.microsoft.com/en-us/home/contact

Tell us your problem: "Account Locked", "Verification Code", "Account hacked or compromised"

[Get Help] {Scroll down to the bottom of the page} [Sign in to Contact Support]

Sign in with any Microsoft account

Products and services: "Other Products"

Category: "Manage Account Security"

[Confirm]

Choose a support option -> "Chat with a support agent in your web browser"
Michael Jackman 0 Reputation points

2026-07-26T00:28:22.0633333+00:00

I am also having this same issue. Its really just annoying that no one at Microsoft seems to understand the issue.

How can 1000+ drafts even be produced and pinned and made important within an hour? Did it ever eventually stop for anyone. still within the 24hr signout window.

Like this is wild.
Hornblower409 16,820 Reputation points

2026-07-26T01:04:08.52+00:00
@Michael Jackman said

I am also having this same issue. Its really just annoying that no one at Microsoft seems to understand the issue.

In many cases the drafts are being produced by malicious code installed by the hacker in your cloud account or by a connected service. There are numerous threads on this problem (like this one) where the Q&A moderators provide possible solutions.

If you have done all the suggested steps and the problem is still present, all I can suggest:

Start a new thread using the "Ask a question" button at the top of this page to create a new Question and include the details for your specific problem and what steps you have already tried to fix it. This provides much higher visibility to your issue than adding on to an old post.

Bring in Microsoft Support so they can examine your cloud tenant for any hidden Rules or other malicious code that you can't detect from your client.

Logon to https://outlook.live.com/

From the main menu: Help -> ? Help

{This should open the Help side panel}

Search Help -> {Your problem} and press Enter

Still need help? [Yes]

If you get "We're here to help": Tell us your problem -> {Your problem, again} [Get Help]

[Sign In] {Use any Outlook/Microsoft account}

Choose a support option -> Chat with a support agent in your web browser
phil remmert 0 Reputation points

2026-10-13T02:48:42.7533333+00:00

@Michael Jackman this has happened to me over the last few days, started about saturday, did have non of the at all in my inbox yesterday, but got them happening again today
Hornblower409 16,820 Reputation points

2026-10-13T11:42:42.2233333+00:00

@phil remmert said

this has happened to me over the last few days,

If the suggestions on this page don't help, I would suggest that you start a new thread using the "Ask a question" button at the top of this page to create a new Question and include the details for your specific problem and what steps you have already tried to fix it.

This provides much higher visibility to your issue than adding on to an existing post, which is only seen by people who are already following this question.

2 answers

Your answer

Ehren Smith 0 Reputation points

2026-02-13T10:14:07.4766667+00:00

HIi Winnie - same issue my side. Have deleyed all app permissions and still getting the fake draft email.
Anonymous

2026-02-15T06:33:09.25+00:00

Hi Ehren Smith

Thanks for your comment. Please make sure you have already tried all the steps mentioned above.

Please sign out of all your devices and change your account password by following these guidance:

How to sign out of your Microsoft account everywhere - Microsoft Support

Change your Microsoft account password - Microsoft Support

After that, delete all emails in your Junk folder.

Also, please go to Outlook Web (https://outlook.live.com) and check Settings > Mail > Forwarding and Settings > Mail > Rules to see if there are any suspicious actions configured.

Thank you for your understanding.
Edoardo Strinati 5 Reputation points

2026-02-15T09:54:28.6533333+00:00

Hi Winnie, I've had the same issue for the last 2 days. Scam draft email appearing in my Drafts folder and then appearning in my Inbox.

I've done every passage written here multiple times.

Changed password

activated 2FA

removed all connected apps

checked login history (after i've changed password I was the only one loggin in, so that's good)

disconnected all devices

deleted all rules

disabled Forwarding

disabled POP

disabled IMAP

As I said, I've done all of this multiple times waiting few hours between attempts to let everything disconnect correctly.

The scam email still appears.

Moreover, tonight a lot of scam emails were sent by my account at 4:40 AM.

I really need to find a solution or to reset the account.

Thank you.
Anonymous

2026-02-18T07:19:06.26+00:00

Hi Edoardo Strinati

Thank you for your comment. Please try going to Outlook on the web via https://outlook.live.com and check your To Do tab to see if there is anything suspicious. If nothing is there, please carefully scan your devices with an antivirus. Finally, from a clean device, change your email password.

Thanks for your understanding.
Zoe Fachikh 0 Reputation points

2026-02-18T14:20:15.2+00:00

I have the exact same issue.

The draft keeps coming in my inbox, I delete it, and it comes back with the new time.
It says my name and email, and my old password. It also says it has photos and videos of me. I want it gone. I've deleted it 1000000 times. I have changed my password, logged out everywhere, checked for any rules etc... the same as the people above have done. I have done it all.

I also chatted to Microsoft who were so rude and would not help me. My limit was reached, and I could not chat with them anymore.

This is how the draft email started.

Hey,

What happened here?

About a few months ago, I gained access to your devices and started tracking your online activity. I was able to hack into your computer and access your email: . Your password was easily compromised.
Anonymous

2026-02-19T07:21:18.19+00:00

Hi Zoe Fachikh

Thank you for reaching out to the Microsoft Q&A Forum. Please try contacting Microsoft Support team directly:

Go to Contact - Microsoft Support

Type a brief description of your issue in the search box.

Click "Get Help", then scroll to the bottom and select "Contact Support”.

Choose the appropriate categories.

It may offer live chat and, depending on your subscription/region, an option to request a callback: Look for and select "Chat with a support agent in your web browser" (during business hours) or a similar callback option (if available). Explain your situation clearly.

If you have already contacted them and received an unsatisfactory response, please try reaching out again. Providing a clear description of your issue and your previous Case ID will help the agent support you more effectively.

Thank you so much for your understanding!
ray bell 0 Reputation points

2026-05-09T10:44:22.4833333+00:00

I have am also having the same issues, I have followed all of the steps above and it has not resolved the issue, I am still getting thousands of draft emails a minute. I managed to speak to someone from Microsoft yesterday who confirmed my account was safe but said I needed to speak to an advisor directly in outlook, which is not possible for me. Is there anyway to resolve this without creating a completely new email address? I have even tried to remove the hackers domain from my safe sender list into blocked list and its keeps reverting back
ray bell 0 Reputation points

2026-05-09T10:46:10.4233333+00:00

Did you manage to get this resolved?
Lea Hanrahan 0 Reputation points

2026-05-10T03:15:21.7266667+00:00

Im having the same issue at the moment - cant get onto anyone from support and done all of the above steps. the emails wont stop
Hornblower409 16,820 Reputation points

2026-05-11T15:16:43.36+00:00

@ray bell and @Lea Hanrahan

You need to start a new thread using the "Ask a question" button at the top of this page to create a new Question and include the details for your specific problem. This provides much higher visibility to your issue than commenting on an old post, which is only seen by people who are already following this question.

(You can put the link for this page in your new Question for reference)

If you need Microsoft Support:

You must have a working Microsoft email account to use Chat or any other Support Services. If you can not logon with your current account, create a new, temporary one at https://signup.live.com (Once you are in Chat you can tell them the actual account with the problem).

Chat Support:

Open a browser to https://support.microsoft.com/en-us/home/contact

Tell us your problem: "Account Locked", "Verification Code", "Account hacked or compromised"

[Get Help] {Scroll down to the bottom of the page} [Sign in to Contact Support]

Sign in with any Microsoft account

Products and services: "Other Products"

Category: "Manage Account Security"

[Confirm]

Choose a support option -> "Chat with a support agent in your web browser"
Michael Jackman 0 Reputation points

2026-07-26T00:28:22.0633333+00:00

I am also having this same issue. Its really just annoying that no one at Microsoft seems to understand the issue.

How can 1000+ drafts even be produced and pinned and made important within an hour? Did it ever eventually stop for anyone. still within the 24hr signout window.

Like this is wild.
Hornblower409 16,820 Reputation points

2026-07-26T01:04:08.52+00:00

@Michael Jackman said

I am also having this same issue. Its really just annoying that no one at Microsoft seems to understand the issue.

In many cases the drafts are being produced by malicious code installed by the hacker in your cloud account or by a connected service. There are numerous threads on this problem (like this one) where the Q&A moderators provide possible solutions.

If you have done all the suggested steps and the problem is still present, all I can suggest:

Start a new thread using the "Ask a question" button at the top of this page to create a new Question and include the details for your specific problem and what steps you have already tried to fix it. This provides much higher visibility to your issue than adding on to an old post.

Bring in Microsoft Support so they can examine your cloud tenant for any hidden Rules or other malicious code that you can't detect from your client.

Logon to https://outlook.live.com/

From the main menu: Help -> ? Help

{This should open the Help side panel}

Search Help -> {Your problem} and press Enter

Still need help? [Yes]

If you get "We're here to help": Tell us your problem -> {Your problem, again} [Get Help]

[Sign In] {Use any Outlook/Microsoft account}

Choose a support option -> Chat with a support agent in your web browser
phil remmert 0 Reputation points

2026-10-13T02:48:42.7533333+00:00

@Michael Jackman this has happened to me over the last few days, started about saturday, did have non of the at all in my inbox yesterday, but got them happening again today
Hornblower409 16,820 Reputation points

2026-10-13T11:42:42.2233333+00:00

@phil remmert said

this has happened to me over the last few days,

If the suggestions on this page don't help, I would suggest that you start a new thread using the "Ask a question" button at the top of this page to create a new Question and include the details for your specific problem and what steps you have already tried to fix it.

This provides much higher visibility to your issue than adding on to an existing post, which is only seen by people who are already following this question.

Answer 1

Hello FRANKIE

Thank you for reaching out to Microsoft Q&A Forum. I understand how alarming this is, even after securing the account, malicious draft emails keep reappearing and you’ve now hit a daily sending limit, so you can’t fully regain control of your mailbox.

I can see the Q&A Assist answer under your post. To avoid repeating it, could you tell me whether you’ve tried those steps yet, and what happens when you try?

In addition, please try the following steps:

1. Double-check the account security

Go to: https://account.microsoft.com/security > Manage how I sign in
Remove any unfamiliar sign‑in methods you don’t recognize
Check the list of devices associated with your account
If you notice anything unusual, change to a strong password and Sign out everywhere
Turn on Two-step verification: How to use two-step verification with your Microsoft account - Microsoft Support

2. Review and secure recent sign‑in

Check Recent activity: https://account.microsoft.com/activity
Choose This wasn’t me/ Secure your account for anything you don’t recognize.

3. Run a quick isolation test

Sign in to Outlook on the web
Delete the malicious drafts (Empty Drafts folder).
Do not open Outlook on any device (PC/mobile/tablet) for 30–60 minutes.
Refresh Outlook on the web and check Drafts again.

4. Remove any hidden mail actions

Still in Outlook on the web, go to Settings > Mail > Rules and Settings > Mail > Forwarding
Review and delete any unknown rules

For more details, you can see this official guide: Fix email sync issues by removing a device from your Outlook mailbox - Microsoft Support

Please feel free to let me know how it goes. I truly appreciate your time and understanding.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Anonymous

2026-02-04T08:29:00.23+00:00

Good day FRANKIE, I hope you're well. May I know if you've got any chance to check my reply? If you have any further updates on this issue, please feel free to reach back. I'm happy to help you.
Louisena Dufleurant 0 Reputation points

2026-02-06T07:49:20.86+00:00

Hello! I'm also experiencing this behavior. I followed all the steps mentioned throughout this thread and even tried closing my account, but the same spam message appears once I reopen by inbox.
Anonymous

2026-02-08T00:36:37.3966667+00:00

Hi Louisena Dufleurant

Thank you for your comment and I’m sorry you’re still seeing the same malicious draft come back even after following all the steps in the thread. When the draft reappears after a full reset like that, the most common remaining cause is an authorized app/service still has access to the mailbox and is recreating the draft automatically (even if your password and rules are clean).

Please check and revoke permissions for unknown apps:

Please visit the Microsoft account app management page: Apps and services you've given access

Carefully review every app on the list. If you see any app that you do not recognize, that looks suspicious, or that you don't remember authorizing, click on it immediately and select "Remove these permissions".

If the draft still reappears after removing any unknown connected apps, please let me know so I’ll guide you on how to contact Support Team for further assistance.

Thanks again for your understanding.

Answer 2

It sounds like your Outlook mailbox may still be compromised despite taking several security measures. Here are some steps you can take to address the issue:

Check for Compromised Account: Ensure that there are no remaining unauthorized access points. This includes reviewing any connected applications and ensuring that all suspicious devices are removed from your account.
Review Mail Forwarding and Inbox Rules: Although you mentioned that rules have been removed, double-check that there are no hidden or re-created rules that could be causing the drafts to appear. Use PowerShell commands to list any existing rules, as some may not be visible in the standard Outlook interface.
Examine Audit Logs: Investigate the audit logs in the Microsoft Entra admin center to identify any unusual activity that might indicate ongoing unauthorized access. Look for signs of logins from unfamiliar IP addresses or locations.
Reset Mailbox Settings: If the problem persists, consider contacting Microsoft support for a backend reset of your mailbox. This may help eliminate any lingering configurations that are causing the drafts to reappear.
Enable Multi-Factor Authentication (MFA): Ensure that MFA is properly configured and that no unauthorized methods are registered.
Scan for Malware: Make sure that your devices are free from malware that could be affecting your email account.

If these steps do not resolve the issue, reaching out to Microsoft support for further assistance would be advisable.

References: