Account Security Problems

How to Stop a Hacker from Recreating an Outlook Mail Rule

Natalie Taylor Oct 9, 2026 869 views

Question details

The user needs to prevent a hacker from continuously recreating malicious email rules in a compromised Outlook account.

How to Stop a Hacker from Recreating an Outlook Mail Rule

Product: Microsoft Outlook
Device & OS: not provided
Scenario: Securing a compromised Outlook email account where unauthorized forwarding or redirect rules keep returning after being deleted.
Observed behavior: A malicious rule automatically marks messages as read, redirects them, and stops other rules. The rule returns repeatedly even after the user deletes it.

Before you start

Before changing your account passwords or security settings, run a comprehensive malware scan on all your devices to ensure the attacker is not actively logging your keystrokes.

Solution 1Recommended

Secure Your Account and Remove Rules Manually

Use this primary method to completely cut off the attacker's access before deleting the malicious rules, ensuring they cannot log back in to recreate them.

If you delete a rule while the hacker still has an active session token, they can instantly deploy a script to recreate it. You must secure the account credentials and sessions first.

Change Your Password

Log into your Microsoft account from a clean, secure device and update your password to a strong, unique combination.

Sign Out of All Sessions

Navigate to the Security settings of your Microsoft account dashboard, select Advanced security options, and choose the option to sign out of all active sessions and trusted devices.

Enable Multifactor Authentication

Turn on Two-Step Verification in your account security settings to require an additional code or prompt when logging in.

Delete Unauthorized Rules

Open Outlook on the web, go to Settings (gear icon) > Mail > Rules, and delete any rules you do not recognize, especially those forwarding or redirecting emails.

Secure Your Account and Remove Rules Manually

Account Monitoring: Keep monitoring your account for 48 hours. If the rules do not return, the attacker's access has been successfully terminated.

Solution 2

Use the Clean Rules Command in Windows

If malicious rules are hidden or persistent across the Outlook desktop app, you can use a Windows command to force-delete all rules.

Solution 3

Review Forwarding and Connected App Settings

Hackers often establish persistent access through connected third-party apps or native forwarding settings that operate independently of standard inbox rules.

Free Microsoft Office alternative

Looking for a Secure and Free Alternative to Microsoft Office?

If you are concerned about email security vulnerabilities or simply need a lightweight, highly compatible office suite for your offline documents, WPS Office is an excellent choice. It provides a secure environment for document management without compromising on functionality.

1. Download WPS Office: Visit the official WPS website and download the free installation package for your operating system.
2. Install the Suite: Run the installer and follow the on-screen instructions to set up WPS Office on your device.
3. Open and Secure Documents: Launch WPS Office to easily open your existing Microsoft Office files and apply robust local password protection.

Seamless format compatibility with Microsoft Word, Excel, and PowerPointAdvanced local document encryption to protect your sensitive filesLightweight installation with fast, responsive performanceFamiliar tabbed interface for a zero-learning-curve transition

microsoft office alternative - wps office

Frequently Asked Questions

Why do deleted Outlook rules keep coming back?

If an attacker still has active session tokens, an authorized connected app, or spyware running on your device, they can automatically recreate the rules via scripts as soon as you delete them. You must fully secure the account (change password, log out everywhere) before deleting the rules.

How do hackers exploit Outlook inbox rules?

Hackers typically create rules to silently forward password reset emails, bank statements, or sensitive communications to their own external address. They often configure the rule to immediately move those emails to your Deleted Items or RSS Feeds folder so you don't notice the incoming mail.

Will the cleanrules command delete rules for all my email accounts?

Yes, running 'outlook.exe /cleanrules' removes rules for all mailboxes that are configured within the specific Outlook profile you open it with. Use it with caution.

Can Microsoft Support delete malicious rules for me?

Microsoft Support can investigate a compromised account and help you lock it down, but they generally expect users to manually clear out rules and forwarding settings using the provided interface or commands.

Microsoft Office Security Issues