Account hacked and I think they changed the email associated with it

Question

Account hacked and I think they changed the email associated with it

Jesse Kelley 20

I accidentally downloaded a virus some time ago. I've been able to recover my accounts everywhere else, but my Microsoft account is weird. Whenever I try to sign into my OneDrive, it prompts me to sign back into my email, then acts like I'm trying to log into an entirely separate email.

User's image

2026-05-08_062528

The microsoft account I'm using right now has the same name as my old account, but isn't connected to anything it used to. When I tried to log into it, it brought me to the account creation page. This makes me think that the virus or the hacker it gave access to my computer to might have taken my existing microsoft account and just changed the email it's associated with. The account recovery form doesn't work because the account supposedly has a different name now, so I really don't know what to do.
User's image

I think it's worth noting that my computer still thinks I'm signed into the original account for some reason? But whenever I try to do anything with it, it brings me to the carbohemo.ru sign-in again.

0 comments

Answer accepted by question author

Darhyl Amizola 50,155 Independent Advisor

Hey there! Nice to meet you!

In addition to what the AI mentioned, the hacker was able to remove your Microsoft account's primary email address/security info, replacing it with the hacker's email address. This is why the system detects that you are using a different account with the same primary email address when signing in.

Since the security info has been replaced by the hacker, I'm afraid there is no other working method to recover the Microsoft account, and Microsoft Support cannot help either.

Thank you for your understanding.

Best regards,

Darhyl

0 comments

1 additional answer

Your answer

Answer 1

The behavior described matches a hacked/compromised Microsoft account where the attacker has changed the sign‑in email and security info. When this happens and the account recovery form does not recognize the original address, there is no direct way to “rename it back” from the client side.

Follow these supported steps only:

Clean the PC before doing anything else
Since a virus was downloaded, run a full malware scan and clean the device before changing any passwords:
- On Windows 10, use Windows Defender (Microsoft Defender): open Start, search for Windows Defender, open it, and run a full scan.
- Ensure real‑time protection and regular automatic scans are enabled.
This is required before changing passwords so that new credentials are not captured again.
Use the hacked‑account recovery flow
Go through the official “hacked or compromised Microsoft account” process:
- Start from the sign‑in helper: it will ask for the email/phone and route to the correct self‑help or support options.
- Then follow the steps to recover a hacked account, including changing the password if sign‑in is still possible, or using the reset flow if not.
If the attacker has replaced the security info and the recovery form cannot validate ownership, there is no alternative manual override; support cannot restore access outside this automated process.
If access is regained, secure the account
After successfully recovering the account:
- Change the password immediately to a strong, unique one.
- Review and correct account settings that may have been altered, such as connected accounts, forwarding rules, and automatic replies. Remove any addresses or rules that are not recognized.
If recovery fails
If the recovery form repeatedly fails and the account is reported as having a different name or not existing, this indicates the attacker has fully taken over and changed the aliases/security info. In that case, the account is effectively unrecoverable under Microsoft’s documented process. A new Microsoft account must be used going forward, and any subscriptions or services tied only to the compromised account cannot be moved by support.
Monitor for unusual activity on any remaining accounts
For any Microsoft accounts still accessible:
- Sign in to the Security basics page and use Review activity to check for unusual sign‑ins. Mark any activity that was not performed as This wasn’t me or Secure your account, and change the password.

These are the only supported remediation and recovery options documented for a hacked Microsoft account where the email and security info have been changed.

References: