Email hacked

Disable forwarding separately from inbox rules, remove any remaining unauthorized mailbox settings, and scan every device used to access Outlook.com; the Bitcoin message may be mailbox content or a synchronized draft rather than proof that malware was installed in Outlook.com.

1. Remove forwarding and other mailbox changes

Since deleting the attacker’s inbox rule did not stop forwarding, check Outlook.com’s separate forwarding control:

1. Open Outlook.com in a browser.
2. Select Settings → Mail → Forwarding.
3. Clear Enable forwarding.
4. Remove the unknown address and select Save. Forwarding configured here is separate from an inbox rule.^1^
5. Go to Settings → Mail → Rules.
6. Delete every rule you do not recognize using More actions (…) → Delete rule.^2^
7. Also review connected accounts and automatic replies, because Microsoft includes those settings in its compromised-account cleanup procedure.^3^

Do not rely on the keyword rule you created to remove the existing Bitcoin content. Outlook.com rules normally apply to messages received after the rule is created; use Delete, Sweep, or manually empty the affected folder for content already present.^2^

If the message is in Drafts and reappears after deletion, wait for the sign-out-everywhere action you already initiated to finish invalidating sessions, then delete it again. Do not pay, reply, open attachments, or follow links in the message.

2. Scan the devices that accessed the account

Changing the password and enabling two-factor authentication protects the account, but it does not remove malicious software from a computer.

On each Windows PC used to access this mailbox:

1. Open Windows Security.
2. Select Virus & threat protection → Scan options.
3. Select Full scan → Scan now. Microsoft’s compromised-account procedure specifically requires a current, full antivirus scan.^3^
4. If needed, download the latest Microsoft Safety Scanner, run a full scan, and review its results. It is an on-demand scanner—not a replacement for real-time antivirus—and expires 10 days after download.^4^
5. Remove anything detected, restart the PC, and update Windows and the browser.

If a scan finds malware, change the Microsoft account password again from a clean device afterward. This repeat is necessary because the password already changed could have been exposed while the infected device remained active.

Also remove unfamiliar browser extensions and inspect any phone or tablet that synchronizes this mailbox. The available Microsoft procedure does not provide device-specific scanning steps for non-Windows platforms; use that platform’s built-in security and update tools.

3. Review the damage

Open the Microsoft account Recent activity page and review the last 30 days of sign-ins, including device and app details.^5^

Then check:

• Sent, Drafts, Deleted Items, and Junk Email for attacker activity.
• Security and recovery information for unfamiliar email addresses or phone numbers.
• Other accounts that used this mailbox for password recovery. Change those passwords directly with the relevant providers, using unique passwords.
• Financial or shopping accounts for unauthorized transactions.

4. If the message or forwarding returns

If an unknown forwarding address or rule returns after the global sign-out has completed and all devices have been scanned:

1. In Outlook.com, select Help from the menu bar.
2. Enter a description of the compromised account.
3. If self-help does not resolve it, scroll to Still need help? and select Yes to contact Outlook.com support.^1^

State that the password, two-factor authentication, and global sign-out are already complete, and that unauthorized forwarding or mailbox content continues to return.

References

1. Turn on or off automatic forwarding in Outlook.com | Microsoft Support
2. Outlook.com
3. How to recover a hacked or compromised Microsoft account | Microsoft Support
4. Microsoft Safety Scanner Download
5. Email is missing from your Outlook.com inbox | Microsoft Support