My Microsoft account was compromised: attacker changed my password, added their own Authenticator app and took over 2FA — how can I recover it?

Hello Microsoft community,

I urgently need help recovering my personal Microsoft account, which was compromised after I interacted with a phishing website.

I use this account for Minecraft and Microsoft services. I am the original owner and still have access to the original email address associated with it.

1. How the compromise started

I received a Discord message connected to a Minecraft PvP server. The server presented a verification or ban-appeal process that directed me to a website pretending to be a legitimate Microsoft verification page.

The website asked me to verify my Microsoft account. I entered a six-digit Microsoft verification code on that page.

I did NOT knowingly provide my Microsoft password to the phishing website.

After entering the verification code, I began experiencing problems accessing my Microsoft account. I suspect the phishing website used the code to gain access to my account.

2. What the attacker changed

After the initial compromise, the attacker appears to have:

• Changed my Microsoft account password.

Added their own two-factor authentication method.

Specifically, added an authenticator app that I do not control.

Added or changed an alternate security email address that I do not recognize.

I am now unable to complete the normal sign-in process because I cannot access the attacker's authenticator app.

3. Security information replacement request

On November 10, 2026, I personally initiated a security information replacement request.

The Microsoft security page showed:

Current security information: an unfamiliar alternate email address.

New security information: my original Gmail address.

Scheduled completion date: December 10, 2026.

Microsoft displayed a message explaining that my security information replacement was pending for 30 days.

I initiated this particular replacement request myself because I wanted to replace the unfamiliar recovery email with my own email address.

I have NOT cancelled this request.

4. Other problems I encountered

I tried changing my password multiple times.

Microsoft eventually stopped allowing further password changes because I had made too many attempts within 24 hours.

Some Microsoft security pages display a message saying that I cannot access them until the security information replacement completes.

I tried accessing the account security and recovery settings, but the pending security information message prevented me from proceeding.

The attacker appears to have changed the password and added their authenticator after my initial recovery attempts.

5. What I still have access to

I still have access to my original Gmail address.

I previously regained access to my Microsoft account and Minecraft Launcher.

My Minecraft username, profile and skin appeared unchanged when I checked them.

I still have screenshots and information about the suspicious Discord server and phishing website.

I cannot currently confirm whether I still have an active Microsoft session.

6. What I need help with

I would appreciate clear guidance from a Microsoft account security specialist or someone familiar with compromised personal Microsoft accounts.

My questions are:

Is there a way to recover my account when an attacker has changed the password AND added their own Microsoft Authenticator app?

Can Microsoft help me verify ownership using my original email address and historical account information?

Does my security information replacement request scheduled for December 10, 2026 still protect me, or has the attacker's newly added authenticator changed the situation?

Can the unauthorized authenticator method be removed after ownership is verified?

Is there an official recovery process specifically for cases where an attacker has taken control of both the password and two-factor authentication?

Can a human support specialist review my case and explain the available recovery options?

I understand that Microsoft has security procedures to prevent unauthorized account access. I am not asking anyone to bypass account security. I am asking for help proving that I am the legitimate account owner and recovering access.

Thank you for your time. This account is important to me, and I would really appreciate any accurate guidance.Hello Microsoft community,

I urgently need help recovering my personal Microsoft account, which was compromised after I interacted with a phishing website.

I use this account for Minecraft and Microsoft services. I am the original owner and still have access to the original email address associated with it.

1. How the compromise started

I received a Discord message connected to a Minecraft PvP server. The server presented a verification or ban-appeal process that directed me to a website pretending to be a legitimate Microsoft verification page.

The website asked me to verify my Microsoft account. I entered a six-digit Microsoft verification code on that page.

I did NOT knowingly provide my Microsoft password to the phishing website.

After entering the verification code, I began experiencing problems accessing my Microsoft account. I suspect the phishing website used the code to gain access to my account.

2. What the attacker changed

After the initial compromise, the attacker appears to have:

Changed my Microsoft account password.

Added their own two-factor authentication method.

Specifically, added an authenticator app that I do not control.

Added or changed an alternate security email address that I do not recognize.

I am now unable to complete the normal sign-in process because I cannot access the attacker's authenticator app.

3. Security information replacement request

On November 10, 2026, I personally initiated a security information replacement request.

The Microsoft security page showed:

Current security information: an unfamiliar alternate email address.

New security information: my original Gmail address.

Scheduled completion date: December 10, 2026.

Microsoft displayed a message explaining that my security information replacement was pending for 30 days.

I initiated this particular replacement request myself because I wanted to replace the unfamiliar recovery email with my own email address.

I have NOT cancelled this request.

4. Other problems I encountered

I tried changing my password multiple times.

Microsoft eventually stopped allowing further password changes because I had made too many attempts within 24 hours.

Some Microsoft security pages display a message saying that I cannot access them until the security information replacement completes.

I tried accessing the account security and recovery settings, but the pending security information message prevented me from proceeding.

The attacker appears to have changed the password and added their authenticator after my initial recovery attempts.

5. What I still have access to

I still have access to my original Gmail address.

I previously regained access to my Microsoft account and Minecraft Launcher.

My Minecraft username, profile and skin appeared unchanged when I checked them.

I still have screenshots and information about the suspicious Discord server and phishing website.

I cannot currently confirm whether I still have an active Microsoft session.

6. What I need help with

I would appreciate clear guidance from a Microsoft account security specialist or someone familiar with compromised personal Microsoft accounts.

My questions are:

Is there a way to recover my account when an attacker has changed the password AND added their own Microsoft Authenticator app?

Can Microsoft help me verify ownership using my original email address and historical account information?

Does my security information replacement request scheduled for December 10, 2026 still protect me, or has the attacker's newly added authenticator changed the situation?

Can the unauthorized authenticator method be removed after ownership is verified?

Is there an official recovery process specifically for cases where an attacker has taken control of both the password and two-factor authentication?

Can a human support specialist review my case and explain the available recovery options?

I understand that Microsoft has security procedures to prevent unauthorized account access. I am not asking anyone to bypass account security. I am asking for help proving that I am the legitimate account owner and recovering access.

Thank you for your time. This account is important to me, and I would really appreciate any accurate guidance.