My Outlook.com email account was compromised, and a malicious inbox rule labeled idtienphuoc1 keeps reappearing even after I delete it. The rule forwards emails to an external address ( _____@hotmail.com ) and stops further processing. I have already: Removed all rules via Outlook Web and Microsoft Graph API (Graph confirms successful deletion, albeit until the rule is replaced with a new ID) Disabled all email forwarding, POP, IMAP Revoked all app permissions via account.live.com/consent/manage Changed my password and enabled 2FA Used incognito and fresh Outlook installs (including new profile) Signed out all sessions - this should mean the hacker no longer has access Despite this, the malicious rule keeps being recreated automatically with a new internal ID, indicating some kind of server-side corruption or unauthorized persistence. I have tried going through support but they aren't able to help, and I'm unable to get in contact with "tier 2" Microsoft support, who I think should be able to perform a backend purge of mailbox rules or inspection of delegated access not visible to user tools Does anyone have experience in solving this? Or can a Microsoft Moderator escalate this to the security or mailbox engineering team? It is clearly a backend persistence issue, not solvable through standard user-facing tools.

JamesAshdown, thank you very much for your instructions. I had the same problem and it helped me a lot!

Thank you very much for your reply. I have changed my password, but i cannot turn 2 factor authentication on because i cannot receive the email needed to complete the procedure. I guess is something with the damn rule. Still trying everything here, but i´m a little noob, so i dont understand most of what Bo said up there. Still tryin, though. Thank you for your help, really. Regards

Hi mate, I just replied to another comment, follow the steps I did and you should be fine - essential thing is you use the desktop and not a phone as you get better settings

Same here. I am very worried. Any solutions to deleting the idtienphuoc1 rule?

Undeletable Inbox Rule placed by a Hacker

Anonymous

My Outlook.com email account was compromised, and a malicious inbox rule labeled idtienphuoc1 keeps reappearing even after I delete it. The rule forwards emails to an external address ([email protected]) and stops further processing.

I have already:

Removed all rules via Outlook Web and Microsoft Graph API (Graph confirms successful deletion, albeit until the rule is replaced with a new ID)
Disabled all email forwarding, POP, IMAP
Revoked all app permissions via account.live.com/consent/manage
Changed my password and enabled 2FA
Used incognito and fresh Outlook installs (including new profile)
Signed out all sessions - this should mean the hacker no longer has access

Despite this, the malicious rule keeps being recreated automatically with a new internal ID, indicating some kind of server-side corruption or unauthorized persistence.

I have tried going through support but they aren't able to help, and I'm unable to get in contact with "tier 2" Microsoft support, who I think should be able to perform a backend purge of mailbox rules or inspection of delegated access not visible to user tools

Does anyone have experience in solving this?

Or can a Microsoft Moderator escalate this to the security or mailbox engineering team? It is clearly a backend persistence issue, not solvable through standard user-facing tools.

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

9 answers

Anonymous

2025-06-24T09:37:41+00:00

JamesAshdown, thank you very much for your instructions. I had the same problem and it helped me a lot!
Was this answer helpful?

0 comments No comments
Anonymous

2025-06-18T21:00:08+00:00

Thank you very much for your reply.

I have changed my password, but i cannot turn 2 factor authentication on because i cannot receive the email needed to complete the procedure.

I guess is something with the damn rule.

Still trying everything here, but i´m a little noob, so i dont understand most of what Bo said up there.

Still tryin, though.

Thank you for your help, really.

Regards
Was this answer helpful?

0 comments No comments
Anonymous

2025-06-18T20:19:19+00:00

Hi mate, I just replied to another comment, follow the steps I did and you should be fine - essential thing is you use the desktop and not a phone as you get better settings
Was this answer helpful?

0 comments No comments
Anonymous

2025-06-18T19:58:46+00:00

Same here.
I am very worried.
Any solutions to deleting the idtienphuoc1 rule?
Was this answer helpful?

0 comments No comments