Outlook account hacked - draft email keeps moving to Inbox in an endless loop (no sender)

Question

Outlook account hacked - draft email keeps moving to Inbox in an endless loop (no sender)

ivy j 20

My Outlook account was recently hacked. I was able to recover it, but I'm still experiencing a very strange issue that I cannot resolve.

Here is everything I've already done:

Changed my password.

Enabled two-factor authentication.

Signed out of all other devices.

Removed unrecognized connected apps.

Checked for forwarding rules (none).

Checked Inbox rules (none).

Turned off POP/IMAP where applicable.

Deleted suspicious drafts.

Scanned my computer for malware.

The problem also happens in Incognito mode and on different browsers, so it doesn't appear to be a local computer issue.

The issue:

A draft email with no sender and no recipient continuously moves from the Drafts folder to my Inbox.

I can see it appear in the Drafts folder for about a second.

It immediately disappears from Drafts and shows up in my Inbox.

This repeats over and over in an endless loop.

My Inbox fills up with these messages, making the account almost unusable.

The email is not being sent to anyone. It is simply being copied or moved from Drafts to Inbox repeatedly.

I have already contacted Microsoft Support through chat multiple times. Unfortunately, each agent only asks me to start a new chat with another agent, and no one has been able to identify or fix the problem.

Has anyone seen this behavior before?

Any suggestions would be greatly appreciated because I've exhausted all the standard troubleshooting steps.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

I have helped others deal with this before, and I have since then compiled this list. It will work. You just have to go through it and give it time.

Please feel free to skip those you already did.

This process can take 24 hours to take effect. So please do not expect immediate results.

Please complete these steps on a computer, not on a smartphone or tablet.

====================

First, go to https://www.outlook.com and sign in.

Click the gear icon in the top right corner to open Settings.

Under Mail, review the following areas:

Rules

If any rules are listed, delete all of them.

Conditional formatting

If anything is set up there, delete it.

Forwarding and IMAP

If you see any entries or settings you did not create, remove them. Turn off POP and IMAP.

Junk

Review Safe sender and blocked list. If you don't recognize any, remove them.

After that, exit Settings and return to outlook.com.

Open the To Do section by clicking the blue checkmark icon on the left side. Delete anything there that was not created by you.

====================

Go to https://account.live.com.

Under Your info > Sign-in preferences, review all aliases on the account. If you see any alias you do not recognize, remove it.

Next, go to the Devices section of your Microsoft account and remove any devices you do not recognize.

====================

Please also do the following in Security section

Change your password

Enable two-step verification

====================

Go here https://account.microsoft.com/privacy/app-access Click on "Don't allow" for anything you don't recognize.

=======================

Then go to Security > Manage how I sign in and make sure all contact information belongs to you.

On that same page, scroll down to App passwords and remove any existing app passwords.

Also on the same page, click on Sign out everywhere. This is intended to disconnect any active sessions that may still be connected. Please note that this can take up to 24 hours to fully take effect.

====================

In addition, this problem can sometimes be caused by a malicious script or infection on one of your devices.

Are you using a Windows computer to check email? Do you use an email app such as Outlook Classic or New Outlook?

If so, please open the app and remove the account from the app settings.

Then go to the Microsoft Safety Scanner download page:

https://learn.microsoft.com/defender-endpoint/safety-scanner-download

Download the 64-bit version, run a full scan, and let me know what the final results say.

=====================

If after 24 hours it still doesn't work, please do this:

Go to your Microsoft account online https://account.live.com> Sign in > Your info > Sign in preference. Add an alias - You have two options here:

Create new: this will allow you to use the native domain outlook.com to create a new alias.

Add existing: this will allow you to add a 3rd party email address, such as yahoo, gmail, as long as they are not already associated with another Microsoft account.

Once added, make this new alias your primary alias, do NOT delete the old alias. Then at the bottom, click on "Change sign in preference". On the next page, uncheck the box for the old alias. This means, from now one, the old alias cannot be used to sign into your Microsoft account, but it can be still used to receive emails, etc.