My account was hacked. I've taken some steps but they seem to have access still.

Run a full malware scan before changing credentials, then remove every unfamiliar app permission, change the Microsoft account password, and use Sign out everywhere to terminate persistent sessions.

1. Contain the compromised device

Because accounts stored in the password manager were also accessed, treat the device and the password vault as potentially compromised.

1. Temporarily stop using the affected computer for email, banking, password changes, or account recovery.
2. Open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now.
3. Install pending operating-system and security updates.
4. If malware is detected, let Windows Security quarantine it and restart the computer.
5. For the most sensitive changes below, preferably use another trusted, fully updated device.

Microsoft specifically recommends completing the malware scan before changing the password; otherwise, malware could capture the replacement credentials.^1^

2. Remove unauthorized app access

Removing the attacker’s 2FA method does not remove permissions already granted to connected applications.

For a personal Microsoft account:

1. Sign in to your Microsoft account.
2. Open Privacy → Overview.
3. Scroll to Other privacy settings → Apps and services.
4. Select Apps and services that can access your data.
5. Open every app you do not recognize and select Remove these permissions.^2^

You can also open Microsoft account consent options and remove permissions for unfamiliar apps or services.^3^

Remove suspicious entries even if their names appear harmless. Legitimate applications might require authorization again later.

3. Replace credentials and terminate sessions

After the scan and app-permission cleanup:

1. Change the Microsoft account password to a new, unique password that has never been used on another site.
2. Open the Microsoft account Additional security options page.
3. Review all sign-in and recovery methods and remove anything unfamiliar. Keep the Authenticator method you already added; there is no need to replace it again unless its device is also compromised.
4. Scroll to Sign out everywhere, then select Sign out.

Global sign-out can take up to 24 hours and signs the account out of browsers and apps, but it does not sign out an Xbox console.^4^

4. Check what the attacker changed

Open Security basics → Review activity and inspect the last 30 days. Expand unfamiliar entries and use This wasn’t me or Secure your account when those options appear.^5^

Also inspect Outlook.com for:

• Forwarding to an unknown address
• Inbox rules that delete, hide, or redirect security messages
• Unknown connected accounts
• Unexpected automatic replies

Microsoft’s compromised-account procedure specifically calls for checking connected accounts, forwarding, and automatic replies.^1^

5. Secure every password-manager account

Assume every credential stored in the vault may be exposed. Change them from a trusted device, in this order:

1. Primary email and password-manager master password
2. Banking, payment, mobile carrier, and identity-related accounts
3. Gaming platforms, including the account linked to Apex
4. Social media, shopping, cloud storage, and remaining accounts

Use a different randomly generated password for every account, revoke existing sessions where offered, and inspect each account’s recovery email, phone number, MFA methods, authorized apps, and purchases. Contact EA/Apex support separately regarding the ban and preserve screenshots, security emails, timestamps, and sign-in records.

Microsoft cannot determine from the visible changes exactly how the attacker added 2FA. Possibilities include stolen credentials, an existing session, phishing, or malware; the containment steps above address each access path without assuming which one occurred.

If unauthorized apps continue appearing after the scan, permission removal, password change, and global sign-out have completed, use Microsoft’s hacked-account sign-in helper. It can provide self-service actions or an option to contact an agent.^1^

References

1. How to recover a hacked or compromised Microsoft account | Microsoft Support
2. Disconnect your LinkedIn and personal accounts | Microsoft Support
3. Sync Microsoft To Do with the Samsung reminder app | Microsoft Support
4. How to sign out of your Microsoft account everywhere | Microsoft Support
5. What happens if there's an unusual sign-in to your account | Microsoft Support