Unauthorized Login Attempt Blocked: Fix It Fast

Quick answer for advanced users

Disable the compromised account, reset the password from a clean device, revoke all app passwords and OAuth tokens, run a full malware scan with Malwarebytes (not just Defender), and enable two-factor authentication using an authenticator app—not SMS.

What's actually happening here?

You got a notification: "Unauthorized Login Attempt Blocked." Maybe it popped up in Windows Security, or you saw it in your Google Account activity log, or Outlook flagged it. Your first instinct is relief—it was blocked, right? But here's the thing: that notification means someone already knows your password (or a close guess at it) and is actively trying to log in. That's not a false alarm. It's a sign your credentials are circulating somewhere they shouldn't be—on a credential list from a data breach, a phishing site, or a keylogger on your machine.

I've dealt with this personally when a client's domain admin account got hit with 400 attempts in one night. The "blocked" part works, but only if you act fast. Let me walk you through the exact steps I use to kill the threat and lock the door behind it.

Step-by-step fix

1. Stop using the compromised account immediately. Sign out of all devices. On Windows 11, go to Settings > Accounts > Other users and remove any unknown accounts. On a Mac, System Settings > Users & Groups > check for suspicious accounts.
2. Reset your password from a trusted device. Use a laptop you know is clean—preferably one that's never touched public Wi-Fi without a VPN. Make it long, random, and unique. I use a 16-character password with symbols, numbers, upper and lowercase. Don't reuse it anywhere else.
3. Revoke all app passwords and OAuth tokens. This is the step most people skip. On Microsoft accounts: account.live.com/Consent/Manage. On Google: myaccount.google.com/security > Third-party access. Remove every app you don't recognize and anything old you forgot about. Hackers often use a forgotten mail client token to slide back in.
4. Run a full offline malware scan. Windows Defender does okay, but it misses a lot. Download Malwarebytes (free version is fine) and run a custom scan with rootkit detection enabled. Boot into Safe Mode first—hold Shift while restarting, then choose Troubleshoot > Startup Settings > Restart > Safe Mode. Scan there. If it finds anything, quarantine it, then run the scan again.
5. Enable two-factor authentication (use an app, not SMS). SMS 2FA can be intercepted via SIM swapping. Use Google Authenticator, Microsoft Authenticator, or Authy. On your account security page, look for "2-Step Verification" and set it up with the app. Scan the QR code, save the backup codes somewhere safe (I keep mine in a KeePass file).

Alternative fixes if the main steps don't stop the alerts

If you're still seeing attempts after the steps above, the hacker might have a persistent foothold—like a session cookie or a saved password in your browser.

• Revoke all active sessions. On Google: myaccount.google.com/security > Your devices > Manage all devices > Sign out all. On Microsoft: account.microsoft.com/security > Sign out everywhere. This kills any live session they might have hijacked.
• Clear browser saved passwords completely. In Chrome: Settings > Autofill > Passwords > Delete all saved passwords. I know it's a pain—I've been there—but if a keylogger or a piece of malware scraped your browser's password store, it's compromised. Export what you need first to a CSV, but store it offline.
• Toggle your account's primary email alias. On Microsoft accounts, you can add a new email alias and set it as primary, then remove the old one. This instantly kills any login attempts using the old alias. Same trick works on Google if you have a custom domain—change the primary email.

How to prevent this from happening again

This is the part that'll save you from a repeat headache. Here's what I do for my own accounts:

• Use a password manager. I use Bitwarden (free tier is solid). It generates and stores unique passwords for every site. No reuse, no weak passwords. I sleep better.
• Monitor your accounts with a breach notification service. Have I Been Pwned is free. Subscribe with your email and you'll get a ping when your data shows up in a breach. Act on it fast.
• Never reuse a password across important accounts. Your email, banking, and social media should each have a completely unique password. If a hacker gets one, they don't get the rest.
• Set up login alerts. Most services let you get a text or email when a new device logs in. Turn that on. It's your early warning system.
• Keep your operating system and browsers updated. Those security patches exist for a reason. I've seen exploits that work on unpatched systems from 2022 still wreaking havoc in 2025.

If you follow these steps, you'll stop the current attack and harden your accounts so the next attempt never even gets close. You've got this.