My Outlook Account Was Hacked — Auto-Reappearing Inbox Rule Forwards All Mails to External Address

ASP 30 Reputation points
2025-09-29T01:40:34.1233333+00:00

Hello Microsoft Team,

About 3 hours ago, I discovered that my personal Outlook account was hacked. I immediately took several security measures:

  • I changed my password 5 times
  • I activated 2FA (Two-Factor Authentication)
  • I removed all trusted devices and sessions
  • I revoked all connected apps
  • I ran a full Windows Defender scan (no threats found)

Despite all these precautions, a malicious inbox rule keeps reappearing in my Outlook account. The rule is named "hntechh" and it automatically forwards all of my incoming emails to the following external email address:

******@gmail.com

I delete this rule manually, but it comes back every time I reopen Outlook or refresh the browser. There are no forwarding settings enabled, and no delegated access given, only this rule which seems persistent and possibly hidden or managed by some backend service.

In addition:

  • I found suspicious drafts that I never created.
  • My email drafts folder had emails written by the attacker.
  • My crypto exchange account was accessed, and approximately 50 USD was stolen from XBOX-related transaction made through my bank card which is saved in my microsoft outlook account.
  • After enabling 2FA, activity logs show no new sign-ins, but the attacker still appears to have partial control, like setting rules or creating drafts.

I reached Microsoft Account Support via live chat. They asked me to create a new alias and make it the primary, which I did. However, they said they cannot intervene directly with Outlook issues and advised me to post here.

Please escalate this issue to the Outlook security or engineering team as it appears the rule is server-side persistent and cannot be removed through normal means. I am concerned about data leakage, privacy, and financial loss.

I would deeply appreciate any urgent guidance or direct action from your security team.

Thank you,

ASP

User's image

<Mod mask PII>

My stolen orders cant find how to refund it

it is stolen by hacker

222222

Outlook | Web | Outlook.com | Account management, security, and privacy

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Answer accepted by question author
Vikki-T 14,115 Reputation points Microsoft External Staff Moderator
2025-09-29T09:03:59.1433333+00:00

Dear ASP,

Thank you so much for reaching out to Microsoft Q&A Forum. 

I hope this message finds you well. I am sorry to hear that your account has been compromised. Microsoft takes such matters very seriously and I will do my best to assist you in resolving this issue promptly. 

We truly understand how frustrating and concerning this situation must be after all the steps you have already taken to try and resolve the issue. We appreciate your patience and persistence in trying multiple solutions. Your efforts do not go unnoticed, and we're here to support you every step of the way. 

As Forum Moderators, we don’t have the authority to directly access or intervene in account-related issues. However, I’m here to help guide you to the right support channel that can assist you further. 

To help you further, we would like to make a Microsoft account privacy request: 

Kindly visit Microsoft | Account Privacy and follow these steps below: 

Sign in your account and click on Privacy 

  • Select you request as Contact us 
  • Choose you region 
  • Choose your product 
  • Describe your privacy concern and your contact email 

image (1)

Please submit your concern to the Microsoft Privacy Team or Data Protection Officer, they will contact you directly. 

Thank you for your time and patience, feel free to keep me updated. 

Was this answer helpful?

2 people found this answer helpful.

4 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. rasoul ghollamzadeh 0 Reputation points
    2026-10-20T10:35:37.6366667+00:00

    My Outlook.com account was recently compromised, resulting in the loss of nearly ten years of important academic and professional emails (2017–2026).

    I have secured my account, changed my password, enabled two-step verification, and removed all unauthorized inbox rules. The security issue appears to be resolved, but my original emails and attachments are still missing, including from Recoverable Items.

    Could you please help me contact the appropriate Microsoft technical support team to investigate whether these messages can still be recovered?

    Recovering my correspondence is extremely important to me.

    Thank you for your assistance

    Was this answer helpful?

  2. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  3. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  4. Palcouk 2,926 Reputation points
    2025-09-29T07:40:42.7366667+00:00

    Access that outook.com mail account via web browser access to check rules/forwards there

    Was this answer helpful?