Outlook hacked with QuickMailChecker_bot — All-In-One Checker (Hotmail • MIX • Xbox) • Auto Login

Sara 15 Reputation points
2026-05-01T13:48:50.1266667+00:00

This morning my inbox was deleted and any new emails I got had "QuickMailChecker_bot — All-In-One Checker (Hotmail • MIX • Xbox) • Auto Login" in the title. You can't see the email, but just the bot screen when you open. I've changed my password, passwordless login has been and is still off. I deleted a strange calendar that showed up. There is a rule that I cannot delete (even on the web version)

Any ideas what to do next?

Outlook | Web | Outlook.com | Email

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

2 answers

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-05-01T13:49:23.21+00:00

    Take these steps to fully clean up the account and stop the malicious rule/bot behavior:

    1. Scan the PC/phone for malware before changing anything else
      • Make sure antivirus is up to date and run a full scan.
      • On Windows 10/11 or 8.1, use Windows Defender:
        1. Select Start.
        2. Search for Windows Defender and open it.
        3. Turn on protection and run a full scan.
      • Ensure automatic updates and regular scans are enabled.
    2. Change the Microsoft account password again
      • After the malware scan completes, sign in and change the password using the official flow: change your password.
      • Use a strong, unique password that is not reused anywhere else.
      • If sign-in fails at any point, use the official reset your password process.
    3. Enable stronger sign-in protection (MFA)
      • Set up Microsoft Authenticator or another second factor so attackers cannot reuse credentials even if they have them.
      • In a similar case from the community, persistent malicious rules stopped after multi-factor authentication was enabled.
    4. Sign out everywhere and revoke access
      • In the Microsoft account security settings, use Sign out everywhere to invalidate all active sessions.
      • Remove any unknown or untrusted apps from Manage app permissions so they can’t keep re-adding rules.
    5. Clean up Outlook.com mailbox configuration Perform these checks in Outlook on the web (Outlook.com):
      • Rules
        • Go to Settings → Mail → Rules.
        • Delete all rules that look suspicious or that reference bots, forwarding, or moving all mail away from Inbox.
        • If a rule keeps reappearing, it usually indicates an active session or app still has access—hence the importance of steps 3–4.
      • Forwarding
        • Go to Mail → Forwarding.
        • Remove any forwarding addresses that are not recognized.
      • Automatic replies
        • Go to Mail → Automatic replies.
        • Turn off any auto-replies that were not configured intentionally.
      • Connected accounts
        • Review connected accounts and remove any that are not recognized.
    6. Check account activity and security info
      • Visit the recent activity page at https://account.live.com/activity to see where and when the account has been accessed.
        • If unfamiliar locations/devices appear, mark them as “This wasn’t me” where available.
      • Add or verify alternate email and phone as security info so recovery is easier if this happens again.
    7. Verify sign-in page and avoid phishing
      • When signing in, ensure the address bar shows login.live.com. If it does not, close the page and navigate manually to Outlook.com.
      • If suspicious emails or links led to this issue, review guidance on recognizing phishing and junk email.
    8. If the account is blocked or issues persist
      • If Outlook.com temporarily blocks the account due to unusual activity, use the Sign-in Helper to unblock.
      • If unblocking fails or the malicious rule continues to reappear even after all steps above, follow the guidance in When you can't sign in to your Microsoft account (linked from the unblock article) to escalate and contact support.

    After completing these steps, monitor the mailbox for a while to confirm that:

    • No new suspicious rules appear.
    • New mail arrives normally without being replaced by bot content.
    • Recent activity shows only expected sign-ins.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

    2 people found this answer helpful.
  2. Alice-N 13,390 Reputation points Microsoft External Staff Moderator
    2026-05-08T07:04:36.3433333+00:00

    Please note that this is a user-to-user community. As moderators, I have limited access to internal development details. My role is to direct users to the appropriate support channels and resources. While I cannot provide backend analysis, I will do my best to assist you within my responsibilities.   

    Hi Sara

    I understand you’re seeing suspicious “QuickMailChecker_bot” messages, your Inbox is being deleted, and there is a mailbox rule you can’t remove (even in Outlook on the web) in your Outlook.com mailbox. I’m happy to help. Please follow these steps:

    1) Check sign-in history and flag anything suspicious

    Review your Microsoft account Recent activity (last 30 days). If you see Unusual activity, expand it and select “This wasn’t me” for anything you don’t recognize.

    2) Remove “persistence”: re-check forwarding and mailbox rules in Outlook.com settings

    Even after a password change, attackers often persist by using Forwarding and Rules. Please review and fix those settings.

    Forwarding

    Go to Settings > Mail > Forwarding and confirm forwarding is Off.

    Rules

    Go to Settings > Mail > Rules and remove any rule you did not create.

    If the rule still cannot be deleted

    If a rule cannot be removed even from Outlook on the web, that strongly suggests the mailbox is still being tampered with or the account needs support-side investigation. Please fill in the account recovery form with as much information and if the form fails, please contact Support via:

    • Visit Contact - Microsoft Support (Only chat support is available for personal account)
    • Type a brief description of your issue in the search box 
    • Scroll down to the bottom > select Sign in to contact support 
    • Log in to another available personal Microsoft account.  
    • Under Products & Services, select "Other Products"; Under Categories, select "Manage account security", and click Confirm. 
    • Click "Chat with a support agent in your web browser" (during business hours)

    3) Try to recover deleted Inbox mail

    Check Deleted Items first. If the messages aren’t there, use Recover items deleted from this folder (Recoverable Items) if available.

    4) Report suspicious messages and avoid interacting with them

    For suspicious/bot-like messages, please report those messages in Outlook.com. Select the email you want to report. Tap ⋮ at the top right of the screen. Select Report Junk from the dropdown menu. Select Junk, Phishing, or Block Sender as needed. See: How do I report phishing or junk email? - Microsoft Support

    Please tell me how it goes. If the problem persists, please don’t hesitate to reply to this thread and I will be happy to help. Have a lovely day!  

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

    Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    Was this answer helpful?