outlook.com hack

grumpycrab

Somebody/thing is setting up a rule  in my friends web mail at
https://outlook.live.com/mail/0/options/mail/rules

I have changed the password, deleted the rule and today it has come back.  How is this happening?  He has AV.  Using Edge. Perhaps Edge needs a reset?  MWB scan?
Its as if the attacker has a camera over our shoulders.  But we're not getting any additional login notifications.  Perhaps there's a "save rule change" button that we're not seeing.  Grrrrrr.

Neil_Jones

set up two factor authentication:

https://support.microsoft.com/en-us/account-billing/how-to-use-two-step-verification-with-your-microsoft-account-c7910146-672f-01e9-50a0-93b4585e7eb4

And then do away with the password altogether:

https://support.microsoft.com/en-us/account-billing/how-to-go-passwordless-with-your-microsoft-account-674ce301-3574-4387-a93d-916751764c43

wongataa

Sign into the webmail.  Change the password and force sign out everything logged into the account so no-one is logged in.  Turn on two factor identification.

If you don't force everything connected to sign out anyone who has access you don't want could still be logged in despite changing the password.

grumpycrab

Done 2factorauth. Involves logging out.  So the hacker isn't logging in. Must be a local actor... Going to scan laptop et al now...

grumpycrab

wongataa said:

force sign out everything logged into the account so no-one is logged in.

How do you do this please?  Is there an option in MS account? cheers.