See the following Apple articles:
If you think your Apple ID has been compromised
If you think your Apple ID has been compromised - Apple Support
Recognize and avoid phishing messages, phony support calls, and other scams
Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support
Phony "tech support" / "ransomware" popups and web pages
Phony "tech support" / "ransomware" popup… - Apple Community
Identify and filter junk mail in iCloud
Report and reduce spam in iCloud Mail - Apple Support
Delete suspicious content from your devices
Delete suspicious content from your devices – Apple Support (UK)
I changed password
See -> Change your Apple ID password -> Change your Apple ID password - Apple Support
Create a strong password for your Apple ID, It is best if your password consists of eight or more characters and include upper and lowercase letters, and at least one number. You can also add extra characters and punctuation marks to make your password even stronger.
Never provide your password, passcode, security questions, verification codes, recovery key or any other account security details to anyone else. Apple will never ask you for this information.
Then see this Apple article: What to do after you change your Apple ID or password
What to do after you change your Apple ID or password - Apple Support