My hotmail is compromised

Dear Ahmed Tarek,

Thank you for reaching out to the Q&A Forum!

I'm very sorry to hear about the ongoing issues with your Hotmail account and the subsequent breach of your DigitalOcean account. It's an incredibly frustrating and serious situation. I understand you've taken all the right steps, and it's confusing why the hacker still has access.

The fact that the hacker can re-add forwarding rules after you've changed your password and enabled two-factor authentication (2FA) suggests they have a persistent, hidden method of access. Simply removing their rules or changing your password isn't enough because they're getting back in through another door. The most likely possibilities are:

1. A Compromised Device: The most probable cause is that one of your devices (PC, Mac, phone, etc.) is infected with malware. This malware could be a keylogger that captures your new passwords as you type them, or it could be a session hijacker that steals your login tokens as soon as you log in. If they have your session token, they don't even need your password to take action within your account.
2. Active Session Token: As you suspected, the 24-hour window for session termination is a key factor. Even after you request a logout from all devices, it can take time for that to be fully enforced. During this period, an active session token can be used to continue performing actions, such as adding a new forwarding rule.
3. Malicious App Permissions: You may have previously granted permissions to a third-party app or service that is now being exploited. These apps can have extensive permissions to manage your mailbox, including adding rules, without needing your password or 2FA.

Recommended Course of Action

To resolve this, you must attack the problem from all angles simultaneously.

Step 1: Secure Your Devices

This is the most critical step. Your accounts will never be secure until you confirm your devices are clean.

• Perform a deep scan of every computer and mobile device you use to access your email. Use a trusted anti-malware solution (like Malwarebytes, Bitdefender, or Norton).
• Consider a factory reset on any device that the scanner flags as having serious issues, or if you're unable to fully remove the detected threats. This is a drastic measure, but it's the only way to guarantee the removal of a deeply embedded threat.

Step 2: Revoke All Permissions and Change Passwords

Even with a clean device, you need to cut off any existing backdoors.

• Log in to your Microsoft account from a clean device.
• Go to Security > Advanced security options > Apps & services that have access to your data.
• Remove all apps and services you don't recognize or no longer use. Be ruthless here—if you're not 100% sure what it is, remove it.
• Change your password again. This is important to invalidate any passwords a keylogger may have captured.
• Change the password for any other account that uses your Hotmail address for password recovery. This includes social media, banking, and shopping sites.

By following these steps, you'll be addressing both the direct access the hacker has to your email and the underlying cause (the compromised device or app) that allows them to regain access. This coordinated effort is your best chance at fully locking them out of your account for good.

Please let me know how these suggestions work for you, or if you'd like assistance in navigating Microsoft's support channels.

Warm regards, 

==========================================================

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".  

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.