Use the official hacked-account recovery flow immediately:
- Start the Microsoft sign-in helper and enter the original email address or phone number for the compromised account. The tool can show self-help options or offer the chance to talk to an agent.
- Before changing any password, run a full malware scan on the PC:
- Open Windows Security
- Go to Virus and threat protection
- Select Scan options > Full scan > Scan now
- If access is regained, change or reset the password right away and use a strong password.
- After access is restored, review account settings that attackers commonly change:
- Connected accounts
- Forwarding
- Automatic replies
- Review recent sign-in activity on the Security basics page. If unfamiliar activity appears, use This wasn't me or Secure your account.
- Add another way to sign in or verify identity in Advanced security options so recovery is easier if this happens again.
If the attacker changed the sign-in email and normal recovery no longer works, use the Microsoft account recovery form or contact Microsoft Support through the support contact flow. Support can route the case correctly, but support agents are not allowed to send password reset links or change account details directly.
If the account is temporarily blocked because of unusual sign-in activity, use the Sign-in Helper to unblock it.
Do not post the attacker’s email address, passwords, recovery codes, or billing details publicly.