Outlook account has been compromised

Varun Shinde 0 Reputation points
2026-10-20T11:55:31.16+00:00

My Outlook.com account was compromised through a malicious OAuth app (Microsoft Graph Command Line Tools). I’ve changed my password, removed the app, enabled two-step verification, and used Sign out everywhere, but an attacker is still inserting extortion drafts into my mailbox. Please revoke all tokens and sessions on my account.”

I sincerely request please help me, i just have no way to talk to or chat with anyone for microsoft support.

Microsoft Security | Microsoft Graph
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Varun Shinde 0 Reputation points
    2026-10-20T13:11:47.9166667+00:00

    Hello,

    I am requesting escalation of this ticket to Microsoft's account security / incident response team. My account is under active compromise and the standard self-service steps have not stopped it.

    WHAT HAPPENED (all times Mountain Time)

    • Oct 19, 10:09 PM: Microsoft emailed me that "Microsoft Graph Command Line Tools" was connected to my account. I did not authorize this.
    • The attacker created a hidden inbox rule (named "2e9e4508329e") to automatically delete emails containing "jagex" or "runescape."
    • Oct 20, 1:19 AM and 3:40 AM: The attacker inserted an extortion message directly into my mailbox as a draft (never sent via email). It demands Bitcoin and contains my stolen credentials.
    • The drafts keep reappearing after I delete them, including after every remediation step below.

    STEPS I HAVE ALREADY TAKEN

    1. Changed my password (twice).
    2. Removed all apps at account.live.com/consent/Manage, including Microsoft Graph Command Line Tools.
    3. Used "Sign out everywhere" on the Advanced security options page.
    4. Enabled two-step verification.
    5. Verified my recovery email, phone, and passkey. No app passwords exist.
    6. Confirmed no inbox rules and no forwarding remain.
    7. Reported the extortion to the FBI IC3 [IC3 complaint #: 5efb56144afa48ca8070f6f54084b3c4].

    The attacker is still writing to my mailbox after all of this. That indicates an active token or grant that the self-service tools do not revoke, possibly through a first-party Microsoft client that does not appear in my connected-apps list.

    WHAT I AM ASKING MICROSOFT TO DO

    1. Revoke ALL refresh tokens, sessions, and OAuth grants on my account server-side, including first-party Microsoft client applications.
    2. Identify which application (client ID) and IP addresses have written to my mailbox since Oct 19, 2026, and confirm that access is terminated.
    3. Check for any remaining persistence: hidden rules, delegates, mailbox permissions, forwarding, linked devices, or registered sign-in methods I did not add.
    4. Preserve all sign-in and mailbox access logs for this account from Oct 15, 2026 onward. This incident has been reported to the FBI and the logs may be requested by law enforcement.
    5. Confirm in writing when the unauthorized access has been fully cut off.

    This is an ongoing criminal extortion attempt using my Microsoft account. Standard troubleshooting has been completed and has not resolved it, so please do not close this ticket with generic security articles. I need a human security specialist to review the account.

    I can provide screenshots of the Microsoft security alert, the attacker's inbox rule, and the extortion drafts with timestamps.

    Please respond within 24 hours. I am available at 7372751897 or this email.

    Thank you,

    Varun Shinde

    ******@outlook.com

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-10-20T11:56:19.68+00:00

    For a personal Outlook.com account, allow up to 24 hours for Sign out everywhere to invalidate browser and app sessions; the Microsoft Graph session-revocation cmdlet cannot be used with personal Microsoft accounts.^1^^2^

    Complete the remaining containment checks

    Since the password, malicious app, two-step verification, and global sign-out have already been handled, do not repeat those actions now.

    1. Wait for the global sign-out to finish
      • Count 24 hours from when Sign out everywhere was selected.
      • During that period, avoid repeatedly deleting the extortion draft; an existing synchronized client may recreate it until its session is invalidated.
      • After 24 hours, delete the draft in Outlook.com and check whether it returns.
    2. Review every remaining application permission
      • Open the Microsoft account Privacy area.
      • Go to Other privacy settings → Apps and services → Apps and services that can access your data.
      • Remove permissions for every app or service that is unknown or no longer needed—not only “Microsoft Graph Command Line Tools.” This is the personal-account location for managing apps with access to account data.^3^
    3. Inspect mailbox persistence settings in Outlook.com In Outlook.com → Settings → Mail, review:
      • Rules: delete rules you did not create.
      • Forwarding and IMAP: disable unknown forwarding. If POP or IMAP is not intentionally used, turn it off.
      • Automatic replies: remove unauthorized content.
      • Junk email: remove unfamiliar blocked or safe senders.
      Microsoft’s compromised-account procedure specifically calls for checking connected accounts, forwarding, and automatic replies after unauthorized access.^4^ Outlook.com exposes POP and IMAP under Settings → Mail → Forwarding and IMAP.^5^
    4. Check recent activity
      • Open the Microsoft account Recent activity page.
      • Expand suspicious entries and select This wasn’t me where offered.
      • Look particularly for:
        • Permission given to an application
        • Automatic sync
        • Successful sign-ins or security changes you do not recognize
      “Automatic sync” can represent Exchange ActiveSync, POP3, SMTP, or IMAP access. The activity page covers the previous 30 days, although it does not display every account event.^6^
    5. Scan every device that accesses this mailbox On Windows, open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now. Microsoft recommends clearing malware before changing a compromised account’s password.^4^ If malware is found, remove it first and then change the password again from a clean device. That second change is necessary because the earlier password could have been captured on the infected device.

    About direct token revocation

    Revoke-MgUserSignInSession invalidates refresh tokens and browser session cookies, but its delegated permission is explicitly not supported for personal Microsoft accounts. It applies to organizational work or school accounts, so installing Graph PowerShell or consenting to another Graph tool is not an appropriate solution for this Outlook.com account.^2^

    Escalate if drafts continue after 24 hours

    While signed in to Outlook.com:

    1. Select Help on the top menu.
    2. Search for compromised account malicious drafts.
    3. If the suggested articles do not resolve it, return to the Help pane, scroll to Still need help?, and select Yes.
    4. In the request, state:
      • The OAuth app’s displayed name.
      • The date and time it was removed.
      • The date and time Sign out everywhere was initiated.
      • That drafts continue after the full 24-hour invalidation window.
      • Any suspicious Automatic sync or application-permission entries.

    This is the documented Outlook.com support-by-email route for users who can still sign in.^7^ Support can investigate, but agents are not permitted to access or directly change account details.^6^

    References

    1. How to sign out of your Microsoft account everywhere | Microsoft Support
    2. Revoke-MgUserSignInSession-Description
    3. Where can I find privacy settings in Microsoft products? | Microsoft Support
    4. How to recover a hacked or compromised Microsoft account | Microsoft Support
    5. POP, IMAP, and SMTP settings for Outlook.com | Microsoft Support
    6. Check the recent sign-in activity for your Microsoft account
    7. How to get support for Outlook.com | Microsoft Support
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.