Volume 31 Issue 11

Issue Date: June 4, 2026 « Previous Issue | Next Issue »

The following articles were included in our Exchange Messaging Outlook (EMO) newsletter published on June 4, 2026.

EMO is a weekly publication. To receive your own copy of EMO by email, subscribe here.

Support Exchange Messaging Outlook Sponsors

Increase Your Productivity!

ReliefJet Essentials for Outlook is a set of more than 160 tools for performing a wide range of tasks in Outlook: processing email messages, contacts, appointments, meetings, tasks and other Outlook items.

ReliefJet Essentials for Outlook

Today's Highlights »

Outlook.com Ransomware and Scams
New Outlook: Junk Email Message Counts
Outlook.com: The Default Email Address Setting Is Broken
Junk Mail Folder Icon

Outlook.com Ransomware and Scams

Kali365 is a new scam that allows cybercriminals to capture Microsoft tokens to bypass multi-factor authentication without stealing a user’s passwords. More information on it is here: FBI Alert on Kali365 hack

How it works: The attacker sends a phishing email that looks like it came from a trusted cloud or document-sharing service. The message includes a code and directions to visit a legitimate Microsoft verification page and enter it.

When the user enters the code, they unknowingly give the attacker access to the account. The attacker can then capture OAuth access details and use them to get into the user’s Microsoft 365 account. From there, they can access Outlook, Teams, and OneDrive without a password or any additional multi-factor authentication.

If you’ve been compromised by this or other hacks or notice unusual activity, If you are asked to pay a ransom, do not pay. There is no guarantee of data recovery, and payments fund further attacks

Secure your account immediately:

Sign in to your Microsoft account at https://account.microsoft.com/.
1. Under Your info, review all aliases on the account. If you see an alias you do not recognize, remove it.
2. Next, go to the Devices section of your Microsoft account and remove any devices you do not recognize.
3. Go to the Security > Manage How I sign in.
  Change your password and enable two-step verification.Make sure all contact information belongs to you.
  At the bottom of the page, review and remove any unrecognized app passwords.
  Click Sign out everywhere.
  Get a Recovery code. Keep it in a safe place, or two. (I save it in a text file on my hard drive and in the Notes app on my phone.)
4. Go to Privacy section > App access and click "Don’t allow" for any app you are not using or don’t recognize.
Run the Microsoft Safety Scanner for Windows to detect and remove malware
If in the US,, report the incident to the FBI's Internet Crime Complaint Center (IC3) and include phishing emails, suspicious logins, and unauthorized devices. If outside the US, many countries have a similar reporting service.
Open Outlook on the web and go into Settings > Mail
In Rules section, if any rules are listed, delete all.In Conditional formatting, delete all formatting rules.
In Forwarding and IMAP. If forwarding is enabled, turn it off. Turn off POP and IMAP.
In Junk Email section, review Safe sender and blocked list. If you don't recognize any, remove them.
Close Settings and return to Outlook. Open the To Do section by clicking the blue checkmark icon on the left side. Delete anything there that was not created by you.

Remember, it’s easier to secure your account before it’s hacked.

Enable multi-factor authentication (MFA) for your Microsoft account (and any other accounts that support MFA)
Avoid clicking links or opening attachments from unknown senders
Verify requests by calling the company directly using a number you know
Keep software updated to patch vulnerabilities
Monitor account activity for unusual logins or devices accessing your accounts

New Outlook: Junk Email Message Counts

New Outlook now shows the total number of messages in the Junk Email and Drafts folders instead of the unread count. Although that change makes sense for those folders, it confused some users because the bold number previously indicated unread messages. They asked what the number in brackets after the folder name means.

Microsoft plans to add a setting later this year that will let users choose whether folders show the total message count or the unread count. The change is expected this fall.

This will align with the options available in classic Outlook. To change the setting for a folder there, right-click the folder, select Properties, and choose either “Show number of unread items” or “Show total number of items.”

Microsoft 365 Roadmap: Outlook: Choose to Show Unread or Total Count for Each Folder

Outlook.com: The Default Email Address Setting Is Broken

Outlook.com accounts normally send mail from the account’s primary alias, but Outlook on the web includes a setting under Settings > Mail > Forwarding and IMAP that lets you choose a different Outlook.com alias as the default for new messages.

This feature is currently broken. If you previously set another address as the default, it should continue to work, but you can no longer change the setting.

Junk Mail Folder Icon

Just a quick reminder: the Junk Email folder icon normally shows a circle with a slash. This does not mean the junk filter is turned off or disabled; it is simply the folder’s standard icon.

If the junk mail filter doesn't seem to be working, it’s a Microsoft problem and is not related to the icon.