my account has been hacked and the hacker activated 2FA so I can't reset my password

Use a different, trusted device for recovery. Don’t enter new passwords on the infected PC yet, or they could be stolen again.

For a personal Outlook/Hotmail account, start with Microsoft’s Sign-in Helper and follow the compromised-account options. Also check your original recovery email for Microsoft security-change notices. If a notice says a security-info change is still pending, use the “This wasn’t me” option. Open Microsoft’s site directly if you’re unsure whether a message is genuine.

Unfortunately, if the attacker has fully enabled two-step verification and you have no usable verification method or recovery code, the normal account recovery form won’t bypass it. Microsoft support cannot simply remove that protection or delete the account without verifying ownership.

Meanwhile, secure your recovery email and other accounts from the trusted device, especially any that reused the password or rely on the stolen mailbox for resets. Use Discord’s hacked-account support separately.

Disconnect the infected PC from the network and clean it before signing in again; for a confirmed credential-stealing infection, a clean Windows installation is the most dependable option. Deleting the email account, even if you regain access, can’t undo information the attacker may already have copied.