- Run a full malware scan on the PC before changing any passwords. In Windows Security, open Virus and threat protection > Scan options > Full scan > Scan now. Microsoft recommends doing this first so malware does not immediately capture new credentials.
- If ransomware is suspected, fully clean the PC with Windows Security before trying to recover files. Do not pay the ransom; Microsoft states there is no guarantee access will be restored.
- Start Microsoft’s hacked-account recovery flow with the Sign-in Helper. It asks for the email address or phone number and then provides the available self-help steps or the option to talk to an agent.
- After the PC scan is complete, try to sign in and change the Microsoft account password. If sign-in fails, use the reset password option.
- If an unusual sign-in alert was received and account access is still possible, go to Security basics and select Review activity. For activity that was not recognized, use This wasn't me or Secure your account, then change the password.
- After access is restored, review account settings that attackers often change: connected accounts, forwarding, and automatic replies.
- Add another way to sign in or verify identity on Advanced security options so recovery is easier if the account is attacked again.
- If the Outlook.com account is blocked because of unusual sign-in activity, use the Sign-in Helper to unblock it. If that still fails, use the Microsoft account sign-in recovery article linked there.
- If the attacker changed the security information and the official recovery process does not succeed, Microsoft support cannot manually recover the account or make security changes on the account. The official recovery flow is the only supported path.
References:
- How to recover a hacked or compromised Microsoft account
- Protect your PC from ransomware
- What happens if there's an unusual sign-in to your account
- How to help keep your Microsoft account secure
- Unblock my Outlook.com account
- My main microsoft account has been hacked and breached and I also have proof - Microsoft Q&A
- My account got hacked and the hacker changed the email. How can i get it back? - Microsoft Q&A