Okay, so I was playing Minecraft, trusted this guy online, and he told me to go to this other Minecraft server, which led me to a Discord server. In the server, I was told to "Verify," which required my email. I gave it to them without a thought. I was then asked for my two-step verification code, which I stupidly gave to them. They instantly got into my account, changed my email and password, and removed the two-step verification and my Windows Hello passkey. They also removed my phone number from the account.
I tried using Microsoft support, but I made the mistake of immediately telling the robot on the line that I had been hacked, which now forced the robot to direct me to their website, regardless of the phone number I called. The website was useless because it would just take me to their password reset site. I filled out the account recovery form, but they ignored it because they set up 2FA on the account they stole. Is there anything I can do?
I've already moved as many accounts as I could off of that email onto a hopefully temporary email. Also, I've been able to monitor what they've changed my email to and my name, as they didn't end my session on Outlook.