hacked account

Question

hacked account

Leo C 0

Hello, My accounts have been hacked and I cant stop them from flooding my inbox with drafts from the hacker. Is there anyway to secure my account and clean the mess up? Please help as theyve locked other accounts out using my email.

Carlos Alfredo Paredes Brito 0 Reputation points

2026-04-28T02:48:44.4366667+00:00
If you received a sextortion email ("I have hacked you, stolen your information and photos") that keeps reappearing as a Draft in Outlook even after deleting it, with a red flag and pin — here is exactly what happened and how to fix it:

What the attacker did: At some point they had temporary access to your Microsoft account (before you enabled 2FA). They connected Microsoft To Do to your Outlook and created an automated task: "when a flagged email is deleted → recreate it." This survived every password change because it lived in To Do, not in Outlook rules.

Why it looks like a Draft: Outlook treats spoofed emails sent from your own address as unsent drafts. The red flag and pin are added automatically by Outlook for "your own" emails.

The fix:

Open Microsoft To Do (todo.microsoft.com)

Search for any task related to that email subject

Delete ALL of them

Go to To Do Settings → disable "Flagged email" sync with Outlook

Change your password and verify 2FA is active

What you DON'T need to do: — Pay anything (it's a bluff, they have no video) — Reinstall Windows — Buy new hardware

1 answer

Your answer

Carlos Alfredo Paredes Brito 0 Reputation points

2026-04-28T02:48:44.4366667+00:00

If you received a sextortion email ("I have hacked you, stolen your information and photos") that keeps reappearing as a Draft in Outlook even after deleting it, with a red flag and pin — here is exactly what happened and how to fix it:

What the attacker did: At some point they had temporary access to your Microsoft account (before you enabled 2FA). They connected Microsoft To Do to your Outlook and created an automated task: "when a flagged email is deleted → recreate it." This survived every password change because it lived in To Do, not in Outlook rules.

Why it looks like a Draft: Outlook treats spoofed emails sent from your own address as unsent drafts. The red flag and pin are added automatically by Outlook for "your own" emails.

The fix:

Open Microsoft To Do (todo.microsoft.com)

Search for any task related to that email subject

Delete ALL of them

Go to To Do Settings → disable "Flagged email" sync with Outlook

Change your password and verify 2FA is active

What you DON'T need to do: — Pay anything (it's a bluff, they have no video) — Reinstall Windows — Buy new hardware

Answer 1

Follow these steps to secure the Outlook.com account and stop the hacker-created drafts and other abuse:

Recover and secure the Microsoft account
1. Go to the official hacked-account recovery flow: How to recover a hacked or compromised Microsoft account and select Start. This uses the sign-in helper tool to guide through recovery.
2. Complete the steps to reset the password and regain control. If the hacker changed security info (alternate email/phone), follow the on-screen options such as reporting an unauthorized change.
3. After regaining access, immediately set a strong, unique password and turn on multi-factor authentication (MFA) for the Microsoft account. MFA blocks most password-based attacks and is the most important protection step. See guidance in What to do if your email address is leaked under Check the locks.
Clean up malicious rules and forwarding in Outlook.com
1. Sign in to Outlook on the web.
2. Open Settings → Mail → Rules and delete any rules that look suspicious (for example, rules that auto-create drafts, forward mail, or move messages unexpectedly). A similar case in the context mentions a rule with a strange name continuously creating ransomware drafts; removing such rules stops the drafts.
3. Go to Mail → Forwarding and remove any forwarding addresses that are not recognized. Attackers often forward copies of mail to their own addresses.
Sign out attackers and remove their access
1. In the Microsoft account security settings, use the option to sign out everywhere so all active sessions (including the attacker’s) are terminated.
2. Review and revoke any suspicious app permissions or connected apps that have access to the account.
Protect other accounts that use the same email
1. For every other service that uses this email address as a username, change the password to a strong, unique one and enable MFA where available. The guidance in Check the locks from What to do if your email address is leaked applies here.
2. If any of those accounts show signs of compromise, follow their specific recovery processes.
Improve ongoing protection and filtering
1. Use spam/phishing reporting in Outlook.com to report malicious messages. This helps tune filters so fewer malicious emails reach the inbox, as described under Tune your filters in What to do if your email address is leaked.
2. Follow the safety guidance in Help protect your Outlook.com email account:
  - Be cautious of unexpected attachments or links.
  - Pay attention to yellow and red safety bars on messages and delete messages flagged as unsafe.
If the account is still not under control
1. If the sign-in helper and recovery form do not restore access, repeat the recovery attempt carefully using the official flow in How to recover a hacked or compromised Microsoft account.
2. If the automated recovery ultimately fails and security info has been fully replaced by the attacker, context indicates there may be no alternative method for consumer Microsoft accounts, and support cannot override the automated checks.

References: