My 25+ years Microsoft account got hacked by someone with bibimail, and I can't recover it

I have a similar problem , so here is what i did , waiting to response my microsoft team : 

Step 0 — Clean your devices FIRST (non-negotiable)

Microsoft's own guidance: run a full antivirus scan before changing any passwords — if an infostealer is still on your PC, the attacker will just steal the new password and re-take the account. Use Windows Defender full scan + a second opinion (e.g., Malwarebytes free scan). Also check your browsers for suspicious extensions and clear saved cookies.

Step 1 — Try the sign-in helper

Go to Microsoft's "How to recover a hacked or compromised Microsoft account" page and use the sign-in helper tool — it routes you to self-help or an agent depending on your situation.

Step 2 — The Account Recovery Form (your main weapon): account.live.com/acsr

Since your alias was removed, this automated form is your primary path. Critical tactics:

Use your ORIGINAL email address as the account identifier, plus a working contact email you control.

Fill it out from a device and location you previously used to sign in — this significantly raises your success odds.

Accuracy beats quantity — wrong guesses hurt more than blanks.

Provide: old passwords (even years-old ones — check browser saved passwords), exact email subject lines (search your other mailboxes for messages you sent from that account), frequent contacts, Skype ID, and especially purchase proof: order numbers, billing name/address, last 4 digits of the card used.

Xbox users: include the console's hardware/Device ID — that field carries heavy weight.

You can submit 2 times per 24 hours; if rejected, improve the data before resubmitting rather than repeating the same answers.

⚠️ If the attacker enabled 2FA on the account, the form may tell you the request will be ignored — that's the hardest scenario.

Step 3 — Escalate to a human via live chat

Go to support.microsoft.com/home/contact, type "MSA", sign in with any other working Microsoft account (create a temporary new one if needed), choose Microsoft 365 and Office → Manage account security → Chat with Support Agent in Web Browser. Ask the agent to suspend/freeze the compromised account to stop the attacker using it (victims have succeeded in getting hijacked accounts suspended this way), and give them your ACSR case number, purchase receipts, and Xbox device IDs. Be honest with yourself about the limit here: support agents cannot manually reset consumer accounts — but they can suspend, and occasionally escalate strong proof-of-ownership cases.

Step 4 — Report the attacker infrastructure

Report the abuse to the registrar: email address removed for privacy reasons (from your WHOIS lookup) — disposable domains used for account takeover can be flagged. (Note :  i dont think it will work.)

Report to Microsoft: https://msrc.microsoft.com/report/abuse and to your local cybercrime authority (e.g., IC3.gov in the US, Action Fraud in the UK).

Part 3 — Protect the Blast Radius (do today)

The attacker will try your Microsoft credentials elsewhere and can reset passwords on anything tied to that inbox:

Change passwords on every account that used the same or a similar password — email, banking, Discord, EA, social media. Use a password manager and unique passwords.

Check the mailbox that received Microsoft's security alerts (the Gmail/etc. that got the "your security info was changed" notification) — Microsoft sometimes includes undo links valid for a limited window. Search it now for any "Remove this alias" or "this wasn't me" links. This is occasionally an instant-recovery path if caught early.

Freeze/notify your bank if cards were stored in the Microsoft account.

If you regain access, immediately: remove the bibimail alias, change password, enable Microsoft Authenticator + a hardware key or passkey, generate and save the 25-digit recovery code offline, review sign-in activity, and purge any malicious Outlook rules/forwarding the attacker set up.