Fix OneDrive Suspiciously Sharing Files With Contacts
Question details
The user's contacts are receiving unexpected notifications about a shared file named One_Docx originating from the user's account, indicating a potential compromise.
- Product
- Microsoft OneDrive
- Device & OS
- not provided
- Scenario
- The user signs into OneNote online and discovers unauthorized sharing activity targeting their contacts.
- Observed behavior
- Contacts receive unauthorized file sharing emails for a file named One_Docx, and the user's sent email history may be missing or deleted.
Immediately contact your colleagues and friends to warn them not to open the shared file or click any links within the notification email to prevent further spread of the malicious file.
Secure your Microsoft account immediately
Change your password and enable two-step verification to stop unauthorized access and lock the attacker out of your account.
If your account is sending out suspicious files, it is highly likely that your login credentials have been compromised. Taking immediate action to secure your login information is the most critical step.
Go to the Microsoft Account Security page, sign in, and select 'Change password'. Create a strong, unique password that you have not used on any other website.
Navigate to 'Advanced security options' in your Microsoft account dashboard and turn on 'Two-step verification' to add an extra layer of protection.
Check the 'Recent activity' page to identify any unfamiliar sign-ins. Use the option to sign out everywhere to terminate any active unauthorized sessions.
Audit sharing permissions and remove malicious files
Revoke access to the suspiciously shared file and delete it from your cloud storage to protect your contacts.
Recover missing sent emails in Outlook
Attackers often delete sent emails to hide their tracks. You can use built-in recovery tools to restore your missing email history.
Try WPS Office for Secure and Lightweight Document Management
If you are concerned about cloud security vulnerabilities or compromised online accounts, WPS Office offers a robust, locally secure, and lightweight alternative to Microsoft Office. It provides powerful editing tools for your documents without forcing you into cloud-only ecosystems.
- 1. Download the software: Visit the official WPS Office website and click the Free Download button.
- 2. Install WPS Office: Run the lightweight installer and follow the on-screen prompts to complete the setup.
- 3. Edit documents securely: Open WPS Office to start securely creating, editing, and saving your documents locally.
Frequently Asked Questions
Why is my OneDrive automatically sharing files without my permission?
This usually indicates that your Microsoft account has been compromised by a malicious actor or a phishing attack. The attacker uses your unauthorized access to distribute infected files or spam to your contact list.
What is the 'One_Docx' file my contacts received?
The 'One_Docx' file is typically a malicious payload or a phishing link designed to steal credentials or install malware on the devices of anyone who mistakenly opens it.
Can I recover emails that were deleted by a hacker?
Yes, you can often recover them by checking the 'Deleted Items' folder. If they were permanently deleted, you can use the 'Email Recovery' add-in available in Outlook on the web to restore purged items.
How do I stop unauthorized people from accessing my Microsoft account?
The most effective method is to immediately change your account password, force a sign-out on all devices through your account settings, and enable two-step verification (2FA) for an added layer of security.
