Microsoft 365 features that help users manage their subscriptions, account settings, and billing information.
First, go to Microsoft's official account recovery page at https://account.live.com/acsr and attempt recovery using the original account information.
If the attacker changed the email alias or enabled two-step verification, the standard recovery form may not work.
Contact Microsoft Support through the official Microsoft website and explain that the account was compromised. Provide previous account information, purchase receipts, and other proof of ownership if requested.
Microsoft Support cannot necessarily restore access when security information has been replaced or two-step verification prevents recovery.
Also, secure the original email account, change any reused passwords, and check other accounts for suspicious activity.