- Start with the Microsoft sign-in helper tool for hacked accounts: Start. It asks for the original email address or phone number and routes to the correct recovery path or support option.
- If access is still blocked, go to the Microsoft account Security basics page and use Review activity to check recent sign-in attempts. If suspicious activity appears, select This wasn't me for unusual activity entries or Secure your account for recent activity entries.
- Change the password immediately if sign-in is still possible. Before changing it, run a full antivirus or malware scan on the PC. Microsoft recommends doing the malware scan first, then changing or resetting the password.
- Check and update sign-in and verification methods:
- Open Edit account info and add or remove email addresses or phone numbers associated with the Microsoft account.
- Open Advanced security options and add another way to sign in or verify identity.
- Keep phone numbers and email addresses used for verification up to date.
- If the account email or phone was changed and sign-in is no longer possible, use the guided support tool mentioned on the account alias page.
- If recovery is still unsuccessful, use Contact Microsoft Support from the Microsoft support page.
The screenshot also shows single-use codes and unusual sign-in alerts. Those are consistent with Microsoft account security notifications. Microsoft states legitimate unusual activity messages come from the Microsoft account team at ******@accountprotection.microsoft.com. Do not share single-use codes with anyone.
References: