Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsAssume the account is fully compromised. Use a trusted, malware-free device; preserve evidence; scan before changing credentials; block the attacker; revoke sessions and refresh tokens; remove unfamiliar MFA methods and app access; reset the password through the provider’s official recovery process; and enroll new, phishing-resistant MFA. Then check email rules, connected accounts, cloud data, and every other account that reused the exposed password.
The exact menus and recovery requirements differ by provider. The sequence below applies broadly, with separate guidance for Microsoft Entra and Microsoft 365 environments where the documented controls are specific.
As an Amazon Associate I earn from qualifying purchases.
What an MFA bypass means for your account
MFA is a second authentication factor, not a guarantee that every existing login is safe. An attacker may have stolen a session cookie, tricked a user into approving a prompt, obtained a recovery code, registered a new authenticator, abused an OAuth application, or changed recovery information after entering the account. A successful bypass therefore has to be handled as an account takeover, even if the password still works and the attacker’s sign-in no longer appears active.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not assume that changing the password alone removes the intruder. Existing browser sessions, mobile refresh tokens, mailbox forwarding rules, delegated access, and newly registered authenticators can survive a password change. Your objective is to establish a clean identity, invalidate old access, remove persistence, and create a new recovery path that the attacker cannot reuse.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Do these things first
- Move to a trusted device. Stop using the computer or phone that may have been infected or remotely controlled. Use a known-clean personal device or an organization-managed device that security staff have checked.
- Record what happened. Note alert times, unfamiliar locations or devices, changed recovery details, new MFA methods, password-reset notices, messages sent from the account, and any files or transactions you did not initiate. Preserve original alert emails and screenshots.
- Scan before changing credentials. Microsoft Support instructs users to run an up-to-date antivirus product and a full scan before changing or resetting the password on a hacked account. Do not enter a new password on a device that could still be capturing keystrokes.
- Contain the account. Use the provider’s official security page, or ask an administrator to disable or block the account while the investigation starts.
- Revoke access and rebuild authentication. Invalidate active sessions and refresh tokens, remove unknown MFA methods and app consents, reset the password, and enroll new MFA from the trusted device.
Work through the sequence even if the attacker appears to be gone. A quiet account can still contain a forwarding rule or a refresh token that permits access later.
Step 1: Work from a trusted device and preserve evidence
Choose the device
A trusted device is one that has not shown malware symptoms, is fully updated, uses a screen lock, and is not shared with the suspected attacker. For a work account, an organization-managed computer is preferable. If every available device may be compromised, contact the provider or your organization’s security team from a separate device before signing in again.
Capture evidence without spreading it
- Save sign-in alerts, password-change notices, MFA enrollment messages, and recovery-email changes as original messages where possible.
- Write down timestamps with the time zone, IP or approximate location shown by the provider, device names, and the actions you recognize as yours.
- Record messages, calendar invitations, cloud-file changes, payment activity, or mailbox rules that you did not create.
- Do not reply to suspicious messages or click links in an alert. Open the provider’s site by typing its known address or using a previously installed official app.
Evidence can help an employer, financial institution, or provider determine what was accessed. Avoid deleting alerts or wiping the device until the relevant security team has advised you, unless an immediate safety or legal requirement says otherwise.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Step 2: Scan for malware before resetting the password
Run a full scan with an up-to-date antivirus program before changing or resetting credentials. This is the order specified by Microsoft Support for a hacked account. A quick scan may miss persistence mechanisms, so use the product’s full-device option and allow it to quarantine or remove findings. If the scan reports a serious infection, disconnect the device from sensitive accounts and complete recovery from another clean device.
No particular scanner is required by the recovery sequence. What matters is that the security software has current definitions, the scan covers the whole device, and you do not type a new password until you have reasonable confidence that the device is clean. For a managed computer, let the security team collect logs and decide whether reimaging is necessary.
Step 3: Contain the account and stop new sign-ins
Personal accounts
Open the provider’s official account-security or sign-in-help page. If the provider offers a “secure account,” “sign out everywhere,” or temporary lock option, use it before attempting recovery. If you cannot sign in, start the provider’s documented recovery form or sign-in helper rather than repeatedly guessing passwords or approving unexpected MFA prompts.
Work and school accounts
Tell the help desk or security team immediately. In managed Microsoft 365 environments, an administrator can block or disable the user while investigating. This prevents normal sign-in while the team reviews logs and removes attacker-created access. Blocking is a containment measure, not a complete recovery: sessions, refresh tokens, delegated access, and mail rules still need review.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Revoke sessions and refresh tokens
Use the provider’s control that revokes active sessions, signs the account out everywhere, or invalidates refresh tokens. A browser session or refresh token may continue authorizing access after a password change, depending on the service. In Microsoft Entra, administrators should use the documented session-revocation control during account recovery. Consumer services use different labels and may take different amounts of time to apply the change.
After revocation, expect to sign in again on every legitimate phone, browser, mail client, and calendar application. That inconvenience is intentional: it separates the new trusted sign-ins from sessions that may belong to the attacker.
Step 4: Remove persistence the attacker may have added
Once access is contained, inspect every place where the account can grant access or receive future messages. Remove only entries you can identify as unauthorized, and save a record before deleting them.
Authentication and recovery settings
- Delete unfamiliar authenticator-app registrations, phone numbers, security keys, passkeys, backup codes, and trusted devices.
- Check the recovery email address, phone number, security questions, and alternate contact details for changes.
- Review recent MFA activity for approvals or registrations you did not initiate.
Applications and connected accounts
- Revoke unfamiliar OAuth or application consent, especially permissions that can read mail, files, contacts, or calendars.
- Remove unknown connected accounts, delegated mailboxes, forwarding identities, browser extensions, and third-party integrations.
- Check sign-in sessions and remembered devices again after removing applications; some services expose these controls separately.
Mailbox and collaboration settings
- Delete automatic forwarding rules and inbox rules that hide, copy, or delete security messages.
- Review automatic replies, signatures, send-as permissions, delegate access, and newly created filters.
- Inspect sent mail, deleted items, drafts, calendar events, shared files, and audit logs for attacker activity.
These checks matter because an attacker can use a forwarding rule or app token to regain visibility after you reset the password. Microsoft’s account-compromise guidance specifically calls for reviewing forwarding rules, automatic replies, connected accounts, and unauthorized application consent.
Step 5: Reset the password in the correct order
Reset or change the password only through the provider’s official recovery flow. Use a long, unique password that has never been used on another service, and do not copy it from a password stored on the possibly infected device.
For malicious changes in Microsoft Entra, Microsoft’s guidance says to set a new password before enrolling new authentication methods. The purpose is to establish a clean, trusted credential before adding another factor. Do not enroll a new authenticator first and then continue using a password that the attacker may know.
If you are still signed in but suspect the session is hostile, do not treat that session as proof of ownership. Start from the clean device, revoke sessions where possible, and complete the provider’s recovery flow. If the password-reset page keeps redirecting, shows an unfamiliar recovery address, or rejects a correct password, stop and use the provider’s account-recovery channel.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Step 6: Rebuild MFA from a clean state
Delete compromised methods
Remove every authenticator, phone number, security key, passkey, or recovery code that the attacker could have added or accessed. If you cannot distinguish a legitimate method from a malicious one, ask the provider or administrator to clear the set and re-enroll known-good methods.
Prefer phishing-resistant authentication
Microsoft’s Entra guidance recommends phishing-resistant options such as FIDO2 security keys, passkeys, and Windows Hello for Business. These methods bind authentication to a device or origin in ways that make common password-and-prompt phishing attacks harder. A FIDO2 security key can also provide an offline recovery factor if the provider supports it.
Use at least two trusted methods when the service permits it, but do not leave an old phone number or authenticator registered merely as a backup. Store recovery codes offline in a location the attacker cannot reach through the compromised account. Never store the only copy in that account’s mailbox or cloud drive.
Test the new setup
Open a private browser window or use a second known-clean device and sign in with the new password and MFA. Confirm that the provider recognizes the correct recovery address, that the new method generates a prompt or code, and that you can reach the documented recovery process without relying on the account’s mailbox. Do not test by repeatedly approving unexpected prompts on the old device.
Step 7: Use formal identity recovery if you are locked out
Microsoft Entra accounts
Microsoft Entra account recovery is designed for complete authentication lockout. The process can use third-party identity verification before new authentication methods are enrolled. An organization’s administrator or help desk should start the documented recovery procedure and verify the employee through its established process.
Consumer accounts and other providers
Use the provider’s sign-in helper, account-recovery form, or documented support channel. Be ready to provide information the provider can verify, such as an earlier recovery address, billing details, account-creation information, or previously used devices, but submit it only through the official site. Recovery requirements and support escalation differ by service, country, account type, and risk level.
Do not pay an unverified “recovery agent,” send passwords or one-time codes to someone who contacts you, or transfer ownership of the account to a stranger offering to restore it. Legitimate support will not need your current MFA code to prove that it can help.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Recovery options compared
The right route depends on whether you still control a trusted factor, how strong your identity proof is, and whether an administrator can revoke sessions centrally.
| Recovery option | Phishing-resistant? | Requires a surviving registered method? | Identity proofing | Speed and escalation | Can revoke existing sessions? | Central management |
|---|---|---|---|---|---|---|
| Change password while securely signed in | Not by itself | Usually yes | Existing authenticated session | Usually fastest, but unsafe from an untrusted device | Only if the provider exposes a separate control | Varies |
| Provider recovery form or sign-in helper | No; it restores access | No, if alternative proof is accepted | Provider-specific questions and signals | Speed and escalation vary by provider | Not stated for providers generally | No |
| Microsoft Entra account recovery | No; new phishing-resistant MFA must be enrolled afterward | Designed for complete authentication lockout | Can use third-party identity verification | Handled through the organization’s recovery process | Administrators can revoke sessions and refresh tokens | Yes, for managed tenants |
| Administrator block and investigation | No; it is containment | No | Organization verifies the user | Immediate when an administrator is available | Yes, when combined with session revocation | Yes, for managed accounts |
| New FIDO2 key, passkey, or Windows Hello enrollment | Yes, when supported and correctly enrolled | Requires a trusted recovery path for initial enrollment | Established during account recovery | Fast after identity is restored | No; revoke old sessions separately | Often available for managed Entra environments |
“Not stated” means the provider-specific behavior is not established by the general recovery guidance; check the affected service’s current documentation before relying on it.
Recommended Free Tools
Step 8: Check the blast radius beyond the original account
Attackers often use one account to reach others. Change passwords anywhere the exposed password was reused, starting with your primary email, financial services, password manager, workplace identity, and cloud storage. Use unique passwords and revoke sessions on those services as well.
- Review bank and payment transactions, saved payment methods, and newly added payees.
- Check sent messages, email forwarding, cloud files, shared links, and newly created OAuth rules.
- Inspect social, shopping, developer, and workplace accounts for changed recovery details or new devices.
- Warn contacts if the compromised account sent phishing messages or fraudulent payment requests.
- Ask your employer’s security team whether mailboxes, shared drives, tokens, or other users were accessed.
The available Microsoft and government guidance supports these account and mail-setting checks, but it does not establish a universal incident timeline. Keep monitoring alerts and transaction activity according to each provider’s retention and notification policies.
Special case: the attacker changed your authenticator or recovery details
Do not keep attempting the old method if the attacker replaced it. First document the changed value, then ask the provider or administrator to clear unauthorized methods and start formal identity recovery. After the password is reset, enroll new MFA and verify the recovery address before restoring other applications.
If the attacker changed your email recovery address, secure that email account separately before using it to recover anything else. If the attacker changed a phone number, contact the mobile carrier about unauthorized SIM changes and add the carrier’s account-protection controls. These steps protect the recovery channel that would otherwise let the attacker take the account back.
Common failure modes and fixes
The password changed, but the attacker is still active
Revoke active sessions and refresh tokens, then inspect OAuth consent, forwarding rules, delegated access, and unfamiliar devices. A password reset does not necessarily invalidate every existing authorization.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
You keep receiving MFA prompts
Deny prompts you did not initiate, stop signing in from the suspect device, and remove the unknown authenticator after account containment. Repeated prompts can indicate that an attacker still knows the password.
The recovery form is rejected
Retry only from a clean device and provide consistent, verifiable account history. If the provider offers an escalation or support route, use it. Do not create a second account with the same recovery address while the original case is open unless the provider instructs you to do so.
You cannot identify which settings are malicious
Ask an administrator or trusted security professional to compare the settings with known-good records. Preserve a copy of the configuration before removal so the organization can investigate how access was obtained.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteYour organization blocks the account indefinitely
That can be an intentional containment action. Follow the organization’s identity-verification process, provide the preserved evidence, and wait for confirmation that sessions, tokens, MFA methods, and applications have been reviewed before returning the account to normal use.
How to prevent a repeat bypass
- Use phishing-resistant MFA where the provider supports it, especially FIDO2 security keys, passkeys, or Windows Hello for Business in Microsoft Entra environments.
- Keep recovery codes offline and maintain more than one trusted recovery method when permitted.
- Test account recovery before an incident, including the sign-in helper, backup method, and administrator escalation path.
- Review connected applications, forwarding rules, and registered devices periodically.
- Use a unique password for every service and protect the password manager with phishing-resistant MFA.
- Train users to reject unexpected MFA prompts and to report repeated prompts immediately.
- For work accounts, define who can block a user, revoke sessions, verify identity, and restore access.
CISA summarizes the security benefit plainly: implementing MFA makes it more difficult for a threat actor to gain access to information systems even when passwords have been compromised through phishing or other means. Stronger, phishing-resistant MFA improves that protection, but only when old sessions, recovery settings, and application access are also removed after an incident.
What administrators should document
For a business or school account, record the account identifier, containment time, session and token revocation, password reset, MFA methods removed and added, applications revoked, mailbox rules changed, identity-verification result, and the date the account was restored. Preserve relevant sign-in and audit logs according to the organization’s retention policy.
CISA Emergency Directive 24-02, issued April 11, 2024, required affected federal agencies to analyze exfiltrated email and reset compromised credentials. The directive is not a universal checklist for every organization, but it illustrates why credential reset and review of potentially exposed email belong in the same incident response.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
