How is my microsoft account compromised?

Question

I have had my Microsoft account ever since Hotmail boomed, and I've had the same super weak six character password up until this year, but it was when one of my google accounts got compromised a few months ago that I decided to check my Microsoft account activity. I was surprised to see that it had registered activity that preceded from 2015 from countries I've never been in, so it was that moment when I made some changes.

I changed the password of every single account on every platform that I used to super lengthy ones with different kinds of character, and after reading on strong passwords, all of them focused on being especially lengthy. I also upped every security measure, adding recovery emails for my most important accounts and phone notifications to nearly all of them.

Then this morning happened. This morning I got a text and an email from Microsoft saying that someone else MAY be using my account and a link to review my activity. I was at work so I left the notification there to check it out later, but about half an hour later I got another text and email saying that my password has been compromised and a link to change my password. I didn't click it right away, I instead tried logging in to check my activity and it made me change my password and offered me to update my security info, which I did, and then I was prompted to log in again, and when I did it asked me to choose between sending a code to my recovery email or sending it through a text (like always after I upped my security).

After I logged in successfully I confirmed that there was unusual activity, as apparently an automatic sync (I don't ever use Microsoft apps, or any app for that matter, only web, even on my phone) from Russia. I refreshed the page because this activity was showing above my last activity (even though it's supposed to show chronologically) and after it was shown correctly I clicked on the arrow beside the activity to see the details again and was I again for a surprise.

The details showed activity from different dates from a small array of different countries none of which are where I live and all of them were automatic syncs. I double checked the rest of the activity and all of them were successful logins all made by me. All of these syncs were successful according to the details and the first one was from late July (last month).

Here's the data, skip if you want:

Protocol: POP3
IP: 185.31.162.106
Account alias: 
Time: 3 hours ago
Approximate location: Russia
Type: Successful sync
You've secured your account since this activity occurred.
Learn about more ways you can protect your account.
Protocol: IMAP
IP: 84.238.84.12
Account alias: 
[email protected]
Time: 8/13/2017 2:22 AM
Approximate location: Denmark
Type: Successful sync
You've secured your account since this activity occurred.
Learn about more ways you can protect your account.
Protocol: POP3
IP: 39.54.232.237
Account alias: 
[email protected]
Time: 8/12/2017 11:00 AM
Approximate location: Pakistan
Type: Successful sync
You've secured your account since this activity occurred.
Learn about more ways you can protect your account.
Protocol: IMAP
IP: 177.142.187.49
Account alias: 
[email protected]
Time: 7/27/2017 12:12 AM
Approximate location: Brazil
Type: Successful sync
You've secured your account since this activity occurred.
Learn about more ways you can protect your account.

How was my account compromised? Who was at fault for this breach? Me or Microsoft? I have my phone on 24/7 and email notifications at all times, how could this happen without my notice? Am I missing something or is this a vulnerability on Microsoft's system? How can I prevent this from happening again?

Answer 1

Changing a password does not typically revoke existing access. I'm not familiar enough with a Microsoft account, so I'll provide a general suggestion that many modern websites use.

Twitter has a section in your profile settings that list all connected applications to your account. This can be other twitter clients, or other services that use your twitter data some way. Once connected, this access usually persists through password changes. See if MS has a similar settings page and if so, revoke every application you see and then if something breaks on your end, add that access back.

So how was your account compromised after the password change? It likely wasn't. The user has an authorization token that hasn't been revoked yet. That would be my guess.

Answer 2

I suspect the email from Microsoft isn't really from them, but is a clever forgery. When doing a quick nslookup of the IPs you listed, they all seem to be tied to junk domains. One of the IPs isn't currently in use. Please check if the email ASKED for any information, as there is a possibility of phishing for passwords or the like here.