My Outlook Account Was Hacked — Auto-Reappearing Inbox Rule Forwards All Mails to External Address

Question

My Outlook Account Was Hacked — Auto-Reappearing Inbox Rule Forwards All Mails to External Address

ASP 30

Hello Microsoft Team,

About 3 hours ago, I discovered that my personal Outlook account was hacked. I immediately took several security measures:

I changed my password 5 times
I activated 2FA (Two-Factor Authentication)
I removed all trusted devices and sessions
I revoked all connected apps
I ran a full Windows Defender scan (no threats found)

Despite all these precautions, a malicious inbox rule keeps reappearing in my Outlook account. The rule is named "hntechh" and it automatically forwards all of my incoming emails to the following external email address:

******@gmail.com

I delete this rule manually, but it comes back every time I reopen Outlook or refresh the browser. There are no forwarding settings enabled, and no delegated access given, only this rule which seems persistent and possibly hidden or managed by some backend service.

In addition:

I found suspicious drafts that I never created.
My email drafts folder had emails written by the attacker.
My crypto exchange account was accessed, and approximately 50 USD was stolen from XBOX-related transaction made through my bank card which is saved in my microsoft outlook account.
After enabling 2FA, activity logs show no new sign-ins, but the attacker still appears to have partial control, like setting rules or creating drafts.

I reached Microsoft Account Support via live chat. They asked me to create a new alias and make it the primary, which I did. However, they said they cannot intervene directly with Outlook issues and advised me to post here.

Please escalate this issue to the Outlook security or engineering team as it appears the rule is server-side persistent and cannot be removed through normal means. I am concerned about data leakage, privacy, and financial loss.

I would deeply appreciate any urgent guidance or direct action from your security team.

Thank you,

ASP

User's image

My stolen orders cant find how to refund it

it is stolen by hacker

222222

jf sougné 0 Reputation points

2025-11-27T13:31:46.0533333+00:00

Exactly the same problem since 20th november 2025, incoming emails are automatically forwarded to [moderator's note: PII removed]@hotmail.com. The name of the rule is the same: hntechh. Can't fix it !
Hornblower409 15,950 Reputation points

2025-11-27T19:07:49.8433333+00:00
@jf sougné

-- The name of the rule is the same: hntechh. Can't fix it !

You will need to involve Microsoft Support.

See the Answer by @Vikki-T below.

If the method given does not get you to someone in Support, you can try:

https://support.microsoft.com/home/contact

When engaging with Microsoft

Clearly detail everything you’ve tried.

Emphasize it's NOT a user-error or local-client issue. It is a backend persistence or mailbox-level compromise not addressable by user tools.

Request escalation to the Outlook Security Engineering or Exchange Online Protection teams.
Vikki-T 11,240 Reputation points Microsoft External Staff Moderator

2025-11-28T05:47:36.0966667+00:00

Hi jf sougné,

Thank you for reaching out to Microsoft Q&A Forum.

I'm very sorry to hear that you’ve encountered this issue. To help resolve this issue more effectively, I recommend that you try contacting support using one of the methods suggested by either me or Hornblower409. These approaches are designed to ensure you receive the quickest assistance possible.

Best regards,
Taboo Breakz 0 Reputation points

2025-12-09T06:13:51.9633333+00:00

hope this advice works for me. have taken me on every level of everything. ipo content, social media , 15 years of workassured to be safe. hahha. etcetc. no help anywhere as of yet!
Vikki-T 11,240 Reputation points Microsoft External Staff Moderator

2025-12-09T14:22:42.21+00:00

Dear Taboo Breakz,

Thank you so much for reaching out to Microsoft Q&A Forum.

As Forum Moderators, we don’t have the authority to directly access or intervene in account-related issues. Please follow the ansswer below and Contact Support as Hornblower409 has shown in the comment above.

Thank you so much for your understanding.

Answer accepted by question author

Vikki-T 11,240 Microsoft External Staff Moderator

Dear ASP,

Thank you so much for reaching out to Microsoft Q&A Forum.

I hope this message finds you well. I am sorry to hear that your account has been compromised. Microsoft takes such matters very seriously and I will do my best to assist you in resolving this issue promptly.

We truly understand how frustrating and concerning this situation must be after all the steps you have already taken to try and resolve the issue. We appreciate your patience and persistence in trying multiple solutions. Your efforts do not go unnoticed, and we're here to support you every step of the way.

As Forum Moderators, we don’t have the authority to directly access or intervene in account-related issues. However, I’m here to help guide you to the right support channel that can assist you further.

To help you further, we would like to make a Microsoft account privacy request:

Kindly visit Microsoft | Account Privacy and follow these steps below:

Sign in your account and click on Privacy

Select you request as Contact us
Choose you region
Choose your product
Describe your privacy concern and your contact email

image (1)

Please submit your concern to the Microsoft Privacy Team or Data Protection Officer, they will contact you directly.

Thank you for your time and patience, feel free to keep me updated.

ASP 30 Reputation points

2025-09-29T11:18:05.2133333+00:00

I tried all the things even i deleted hidden rules from MFCMAPI yesterday today first time i tried to delete rule from edge browser and it is succesfull for last 10 minutes. I dont know It will be appear again or not I will observe this for more and will be sure about it.

Thank you for your idea I will do it if it will be appear again or any suspicious action I will see in my account until the end of the day.
Vikki-T 11,240 Reputation points Microsoft External Staff Moderator

2025-10-03T09:06:32.13+00:00

Hi ASP,

Thank you for your time and patience, I truly appreciated it.

Please feel free to keep me updated about the issue so I can fully support you.
ASP 30 Reputation points

2025-10-03T21:50:39.3666667+00:00

I reached microsoft support and they connected to my pc did some settings also delete all connected apps etc. now it seems like rule is gone and draft mails is not appearing anymore.

My problem is solved..
Vikki-T 11,240 Reputation points Microsoft External Staff Moderator

2025-10-06T07:49:55.57+00:00

Hi ASP,

Thank you so much for your patience and for trusting our guidance throughout the troubleshooting process. Your cooperation played a key role in helping us identify and resolve the issue successfully.

If you need any further assistance or have additional questions, please don’t hesitate to reach out. We’re always here to support you.

1 additional answer

Your answer

jf sougné 0 Reputation points

2025-11-27T13:31:46.0533333+00:00

Exactly the same problem since 20th november 2025, incoming emails are automatically forwarded to [moderator's note: PII removed]@hotmail.com. The name of the rule is the same: hntechh. Can't fix it !
Hornblower409 15,950 Reputation points

2025-11-27T19:07:49.8433333+00:00

@jf sougné

-- The name of the rule is the same: hntechh. Can't fix it !

You will need to involve Microsoft Support.

See the Answer by @Vikki-T below.

If the method given does not get you to someone in Support, you can try:

https://support.microsoft.com/home/contact

When engaging with Microsoft

Clearly detail everything you’ve tried.

Emphasize it's NOT a user-error or local-client issue. It is a backend persistence or mailbox-level compromise not addressable by user tools.

Request escalation to the Outlook Security Engineering or Exchange Online Protection teams.
Vikki-T 11,240 Reputation points Microsoft External Staff Moderator

2025-11-28T05:47:36.0966667+00:00

Hi jf sougné,

Thank you for reaching out to Microsoft Q&A Forum.

I'm very sorry to hear that you’ve encountered this issue. To help resolve this issue more effectively, I recommend that you try contacting support using one of the methods suggested by either me or Hornblower409. These approaches are designed to ensure you receive the quickest assistance possible.

Best regards,
Taboo Breakz 0 Reputation points

2025-12-09T06:13:51.9633333+00:00

hope this advice works for me. have taken me on every level of everything. ipo content, social media , 15 years of workassured to be safe. hahha. etcetc. no help anywhere as of yet!
Vikki-T 11,240 Reputation points Microsoft External Staff Moderator

2025-12-09T14:22:42.21+00:00

Dear Taboo Breakz,

Thank you so much for reaching out to Microsoft Q&A Forum.

As Forum Moderators, we don’t have the authority to directly access or intervene in account-related issues. Please follow the ansswer below and Contact Support as Hornblower409 has shown in the comment above.

Thank you so much for your understanding.
ASP 30 Reputation points

2025-09-29T11:18:05.2133333+00:00

I tried all the things even i deleted hidden rules from MFCMAPI yesterday today first time i tried to delete rule from edge browser and it is succesfull for last 10 minutes. I dont know It will be appear again or not I will observe this for more and will be sure about it.

Thank you for your idea I will do it if it will be appear again or any suspicious action I will see in my account until the end of the day.
Vikki-T 11,240 Reputation points Microsoft External Staff Moderator

2025-10-03T09:06:32.13+00:00

Hi ASP,

Thank you for your time and patience, I truly appreciated it.

Please feel free to keep me updated about the issue so I can fully support you.
ASP 30 Reputation points

2025-10-03T21:50:39.3666667+00:00

I reached microsoft support and they connected to my pc did some settings also delete all connected apps etc. now it seems like rule is gone and draft mails is not appearing anymore.

My problem is solved..
Vikki-T 11,240 Reputation points Microsoft External Staff Moderator

2025-10-06T07:49:55.57+00:00

Hi ASP,

Thank you so much for your patience and for trusting our guidance throughout the troubleshooting process. Your cooperation played a key role in helping us identify and resolve the issue successfully.

If you need any further assistance or have additional questions, please don’t hesitate to reach out. We’re always here to support you.

Answer 1

Palcouk 2,926

Access that outook.com mail account via web browser access to check rules/forwards there

ASP 30 Reputation points

2025-09-29T11:14:34.62+00:00

I tried from all devices and browsers but couple of minutes ago i tried to delete from edge browser. It is not appearing again for last 5 minutes. I am currently observing that it may have been successful.