Yes—there is one official recovery path, and it should be started immediately:
- Run a full malware scan on the PC before changing anything.
- Open Virus and threat protection.
- Select Scan options > Full scan > Scan now.
- This matters because changing the password before removing malware can let the attacker steal the new password too.
- Use the Microsoft sign-in helper or Recover your account flow.
- Try the original email address, phone number, Skype name, or any other alias previously on the account.
- Double-check the email domain and spelling.
- If a security code can still be received, complete verification and set a new password.
- If the alias was removed and normal sign-in no longer works, use the Microsoft account recovery form.
- Complete it from a device and location commonly used with the account if possible.
- Include as much historical account information as possible, such as older passwords.
- Microsoft reviews the answers and responds within 24 hours.
- If two-step verification was turned on and none of the alternate verification methods are accessible, the account cannot be recovered through support.
- Support agents cannot send password reset links or change account details.
- If access is recovered, immediately review account settings.
- Check connected accounts, forwarding, and automatic replies.
- Add another sign-in or verification method in Advanced security options.
- Consider enabling passwordless sign-in with Microsoft Authenticator.
If the attacker replaced the security info and alias, the recovery form and sign-in helper are the only supported options.
- How to recover a hacked or compromised Microsoft account | Microsoft Support
- Help with the Microsoft account recovery form | Microsoft Support
- My username and password have stopped working | Microsoft Support
- How to help keep your Microsoft account secure | Microsoft Support
- Change the email address for your Microsoft account | Microsoft Support