Spam Drafts in My Inbox Auto Generating

Hello,

Make sure you do this on a computer, not on smartphone or tablet. Go to https://www.outlook.com and log in, click on the gear icon on the top right to launch the settings.

Then, on the Mail tab, go to Rules. Are there any rules set up here? If yes, delete them all.

Then check the conditional format, again, if it's there, delete it.

Then, check Forwarding and IMAP, If any items are present, delete them as well.

===========

If you can't find anything, go to https://account.live.com > Your info > Sign in Preferences. Make sure to check all the aliases here. If you don't recognize any there, delete it.

Then go to Security > Manage How I sign in, make sure all contact info is yours. Then scroll down on the same page, look under App Password, click on remove existing app passwords as well.

Please make sure you change your password and enable two-step verficiation.

Go to your account online, go to Devices, remove any devices you don't recognize.

Then go to Security, click on Sign out everywhere. This is meant to kill any session that's still connected. Unfortunately, this one will take 24 hours to take effect.

Then, take one step further - Go to your Microsoft account online https://account.live.com> Sign in > Your info > Sign in preference. Add an alias - You have two options here:

Create new: this will allow you to use the native domain outlook.com to create a new alias.

Add existing: this will allow you to add a 3rd party email address, such as yahoo, gmail, as long as they are not already associated with another Microsoft account.

Once added, make this new alias your primary alias, do NOT delete the old alias. Then at the bottom, click on "Change sign in preference". On the next page, uncheck the box for the old alias. This means, from now one, the old alias cannot be used to sign into your Microsoft account, but it can be still used to receive emails, etc.

It sounds like your account has been compromised, and the spam drafts are likely being generated by a hacker who still has access to your account. Here are some steps you can take to stop the spam drafts:

1. Check for Suspicious Rules: Sign in to Outlook Web and navigate to Settings → Mail → Rules. Look for any rules that seem suspicious or that you did not create, and delete them.
2. Review Forwarding Settings: In the same settings menu, check Mail → Forwarding for any unknown forwarding addresses and remove them.
3. Sign Out Everywhere: Go to Microsoft Account Security and use the option to sign out everywhere to terminate all active sessions.
4. Manage App Permissions: Visit Manage App Permissions and revoke access to any apps you do not recognize, as hackers may use these to maintain access.
5. Monitor for Further Issues: After taking these steps, keep an eye on your account activity for any further suspicious behavior. Consider resetting your password again and enabling multi-factor authentication (MFA) if you haven’t already.
6. Scan Your Devices: Run a full antivirus scan on all devices you use to access your email to ensure they are not compromised.

If the problem persists, you may need to contact Microsoft support for further assistance.

References:

• Hacker set up continuous draft ransomware email - Microsoft Q&A
• My personal hotmail account hacked by hacker with authentication app enabled. - Microsoft Q&A