Fully compromised Microsoft 365 Family account - hacker owns 2FA and recovery email - need urgent help

Question

Fully compromised Microsoft 365 Family account - hacker owns 2FA and recovery email - need urgent help

Liam 0

Hi Microsoft Community,

My Microsoft account has been fully taken over by a hacker and I have exhausted every automated recovery option. I am hoping a Microsoft staff member or moderator can help escalate my case.

WHAT HAPPENED

My account was compromised via a cookie stealer application which stole my active browser session. The hacker used my saved credentials to take full control of my account.

WHAT THE HACKER HAS DONE

Changed my primary alias from my original Gmail to a random Outlook address
Changed my account password
Deleted my passkey and security info
Set their recovery email to an address at blackfirsta.com (a documented spam domain used in multiple Microsoft account takeovers)
Enabled two-step verification on their own devices

MUSTAFA SALAH 1,880 Reputation points

2026-06-10T15:48:44.76+00:00

If you tried this https://account.live.com/acsr before.

Only way is live support case / https://support.microsoft.com/contactus
Javith Aponso 0 Reputation points

2026-07-16T09:20:48.76+00:00

Omg same bro and microsoft is doing nothing to save us like litterliy nothing its so annoying

2 answers

Your answer

MUSTAFA SALAH 1,880 Reputation points

2026-06-10T15:48:44.76+00:00

If you tried this https://account.live.com/acsr before.

Only way is live support case / https://support.microsoft.com/contactus
Javith Aponso 0 Reputation points

2026-07-16T09:20:48.76+00:00

Omg same bro and microsoft is doing nothing to save us like litterliy nothing its so annoying

Answer 1

I understand your frustration.

Unfortunately, there is nothing that can be done to recover the account once the hacker is able to modify the account security info.

Please be advised that Microsoft Support will not be able to assist you with manual recovery, unblock, and escalation for this case, as stated in this article, that they are not permitted to send password resets, access, or even change any details on the account:

https://support.microsoft.com/account-billing/help-with-the-microsoft-account-recovery-form-b19c02d1-a782-dee6-93c3-dc8113b20c42

As for the payment card and the subscription in your account, you will need to reach out directly to your bank immediately and request to block all charges from Microsoft, preventing unauthorized purchases and cancelling the subscription on its renewal in the process.

You may also need to request a new payment method.

Best regards,

Darhyl

Answer 2

Darhyl Amizola 46,465 Independent Advisor

Hey there! Nice to meet you!

I'm sorry you are experiencing this.

Since the security info has been replaced and the 2FA has been enabled by the hacker, I'm afraid there is no other working method to recover the Microsoft account, and Microsoft Support cannot help either.

Thank you for your understanding.

Best regards,

Darhyl

Liam 0 Reputation points

2026-06-12T04:41:44.3633333+00:00
Hi Darhyl,

Thank you for your response. I understand the automated recovery tools cannot help in this situation, however I am not willing to accept that this account is unrecoverable.

I have already taken the following steps:

Filed an official report with the Australian Cyber Security Centre

Identified the hacker's recovery email domain as blackfirsta.com, a documented spam domain used in multiple identical Microsoft account takeover attacks

Collected multiple official Microsoft security emails as proof of ownership

Contacted Microsoft's official support channels

I am requesting that this case be escalated to Microsoft's dedicated account security team for manual review. I understand this goes beyond standard community support, but given the severity of the situation, including a credit card on file and a Microsoft 365 Family plan, I believe manual intervention is warranted.

Could you please provide a direct escalation path to Microsoft's account security specialists?

Thank you,

Liam