I have 2-step authentication turned on for my Outlook.com account and I generate app passwords to access the services on certain devices. I am wondering about possibility of hacking my account with app password.
Imagine this situation for example. Say I accidentally download a malicious application on my mobile device which asks me to log in with Outlook.com account. So, I generate an app password on my PC and provide it to this application. But this malicious software sends my username and password(which will be app password) to a hacker in background.
In this scenario, can the hacker gain total control of my account?
If not total control, what would he/she be able to do with app password?
I have mentioned Outlook.com in my question but its very much applicable to other services such as Gmail etc.