Managing personal Outlook.com account settings, security, and privacy
Hi Carol, I am so sorry to hear you're going through this nightmare; dealing with a compromised account while stuck in an automated loop is incredibly violating and stressful. First, a piece of crucial technical clarity: the email you received claiming a "troyano" (trojan) was placed in your computer to add drafts and steal your passwords is a common extortion scare tactic, but because your Microsoft Authenticator, OneDrive, and secondary accounts were actually taken over, it confirms that the attacker successfully hijacked your active browser cookies or compromised your master password.
Because two-factor authentication (2FA) is active, Microsoft's automated Account Recovery Form (ACSR) will reject your entries by design, meaning your absolute last line of defense is bypassing the automated loops entirely to reach high-level manual intervention. You need to immediately head over to X (formerly Twitter) and send a detailed direct message to @MicrosoftHelps or @XboxSupport, providing your previous case reference numbers and explaining that an attacker compromised your master account, modified your primary security aliases, and locked you out of your 2FA methods. The social media support teams monitor a separate, human-vetted escalation queue that has the backend authority to break the automated scripts, trigger an offline verification link, and freeze the compromised OneDrive data before the hacker can do further damage.