The scariest part first
Right now, this is happening to people.
One morning you can't log in to your Microsoft account — the single ID you use for Windows and email. Someone has changed your password. You rush to "forgot password" to reset it, and find that the recovery email and phone number that were supposed to be yours have been rewritten to someone else's. So the reset code doesn't come to you. It goes to the attacker.
You tell Microsoft, "This is my account." You show your purchase history, your old password, proof that it's you. And still —
You don't get it back.
The automated recovery process doesn't clear. Reaching a human agent is hard. Even with evidence, it ends in "we couldn't verify this." Reports like this are piling up on Microsoft's own official support forums. Email, photos, contacts, the software you bought with that account — all of it now belongs to whoever holds the key.
This is not just about "people who carelessly clicked a bad link." The problem is in the design itself.
Why does this happen?
The answer is simple: because everything is bundled into one ID.
With the single ID called your Microsoft account, you:
- log in to Windows
- read your email (Outlook)
- store your files in OneDrive
- buy software
- and ask for help when you get hacked
All the same key. So when that one key is stolen, your whole life goes with it. And the worst part is that even the place you go for help is inside that same locked door. Imagine your house key is stolen, and the "spare-key reissue desk" is inside the house — once the thief locks it from within, you can never get back in. That is what is happening.
Where is the key stolen from?
You might think, "I'm careful, I'll be fine." But the thieves' methods get more sophisticated every year. Look at the numbers.
- Malware built specifically to steal passwords (called infostealers) stole roughly 1.8 billion login credentials in 2025 alone.
- In June 2026, Microsoft accounts faced 81 million login attempts in just two weeks — attacks that try stolen passwords one after another.
- Microsoft is the most impersonated brand in the world for phishing (fake login screens). That's how many "screens pretending to be Microsoft" are out there.
In other words, your password may already be for sale somewhere. That is the scale at which they're being stolen.
And the most infuriating part — the ad is the entry point
Here is what I most want to raise this time.
Recent Windows now shows ads even in the screen where you view your files (File Explorer). They've crept into the Start menu, the lock screen, and the Settings screen too.
This is not a matter of "annoying." It's dangerous.
Think about it. File Explorer is the screen where you look at "your own files." It's the place on your PC you trust most. Opening a channel that pipes ads from outside into that screen means —
that same channel can pipe in malware, too.
"It's showing on a Microsoft screen, so it must be safe" — that sense of safety is exactly what gets turned against you. Disguised as an ad, it gets you to click, and lets malware in. And what if that malware is the "password-stealing malware" from earlier? The passwords saved on your PC get stolen all at once.
So it connects like this:
The ad is the entry. The stolen password is the exit. An ad in File Explorer → malware gets in → your saved passwords are stolen → your account is taken over → you can't get it back.
They look like separate complaints, but they're one line. Microsoft rented out your most trusted screen to strangers, for ad money — and this danger is the price. They sold trust for profit. You pay the bill.
So what should you do?
Don't stop at being angry — that would waste it. There are things you can do today. In order.
Do right away (takes minutes)
- Turn on multi-factor authentication. It requires not just your password but a confirmation on your phone. This alone stops most takeovers. Find it under "Security" in your Microsoft account.
- Check that your recovery contacts (backup email and phone) are still yours. Having these rewritten by someone else is the scariest move in a takeover. Check them regularly.
- Move the passwords saved on your PC into a dedicated password manager. Passwords memorized by your browser or OS are a favorite target for malware.
- Turn off the "recommendations" (= ads) in File Explorer and the Start menu, in Settings. Close the channel itself.
Do over a little more time (the real fix)
The above is first aid. The root problem was "bundling everything into one ID." So the real fix is unbundling.
- Don't leave your important files parked only in someone else's cloud — keep a copy in your own hands (your own PC, or storage you control).
- Don't gather your email and logins all into one company's single ID. Split the keys.
- And the surest step is moving the OS itself away from Windows. The recommendation is a free OS called Debian. It is not run by a single company "for profit" — it is a public tool that volunteers around the world have grown over more than 30 years. No ads. Nothing sneaks AI into it. No single company holds your account. The key is in your own hands from the start.
And you don't need to buy a new computer. You can replace the Windows PC you already use with Debian, on the same machine. Erase Windows, install Debian — and that alone turns it into your own workspace, with no ads, no uninvited AI, no account held by one company. It's common for a Windows PC that had become "too slow to use" a few years ago to come back astonishingly light once it's running Debian.
And this is by no means a move to "some fringe OS for oddballs." Quite the opposite. This autumn, Google itself is said to be releasing a new laptop (a "Googlebook") that runs Debian directly. Public tools like Debian are moving to become the mainstream side. Anyone replacing their Windows now is not an oddball — they're simply getting ahead of what's coming. So there's nothing to worry about.
"That sounds hard," you might think. But now you have AI beside you. This is an era where you can proceed by asking AI, one step at a time, what to do. The difficulty has dropped far below what it used to be. In fact, there's a series that guides you through this path from the very beginning (link below).
In closing — the key belongs in your own hand
This is not a "let's hate Microsoft" story. It's a problem of structure.
Bundling everything into one ID, selling a screen that should be trustworthy to advertisers, and being unable to get your account back once it's stolen — this is the danger inherent in the very shape of "entrust everything to one company." This time it happened to be Microsoft, but the same thing can happen with concentration on any single company.
So there is just one thing to remember.
Keep the key in your own hand, not someone else's.
Rather than searching for a way to recover after it's stolen, build in advance a shape where your life doesn't break even if it's stolen. That is the surest defense.
To learn more — why the "bundle everything into one ID" shape is dangerous, and how to take it back into your own hands, is covered in detail in:
- Independence from the Cloud — AI Supports Only the Open Layers
- The Lord Class Self-Destructs — The Limits of Big Tech's Enclosure
- A guide that starts from turning the computer in front of you into Debian: Learning Debian with Claude
- Concrete steps for moving your whole toolset: AI-Native Ways of Working — Software