I fell for this on a website called Mutaz, which I was using to download apps. I had just woken up and started working on some files when I decided that I needed a newer version of Photoshop. As far as I know, they managed to compromise one of my Gmail accounts associated with Steam, my Steam account, and my Instagram. They even posted two stories on my Instagram related to some crypto shit!
I’ve changed all my passwords, enabled 2FA everywhere, and even froze my bank cards because I had one of them saved in Google Chrome.
My question is: I ran two deep scans with Malwarebytes and quarantined everything it found. Can I safely copy my work files to the new Windows installation after reinstalling Windows, or is that still risky? I have around 2 TB of work files, including PSDs, PDFs, Illustrator files, Blender files, etc.
Not everybody is good with computers. If someone robbed you because you trusted him. Still natural selection? Just a thought to expand your thinking. You cant be good at everything. That said some people are dumb as a tree
If a dude walked up to me and said "lemme hold your debit card up to my pos-system rq" and I let him then I think it kinda of is natural selection if that leads to me getting my money stolen
WHAT!?!? You think this is a hacker being sneaky or something? Those numbered instructions are "open prompt, copy text, and run command".
You literally DID manually copy a command into the command line. How tf do you have 2tb of "work" data and not know that? I legitimately did not know this still worked on anyone under the age of 80.
The only thing it did was put a script in your clipboard, you did the rest. You pressed Ctrl V which opens a run window on your computer that can start all sorts of things. Then you pasted the script put in your clipboard into the run window, then you ran the script by pressing enter.
It doesn’t do anything automatically other than putting it in the clipboard. You would have manually had to open run with Windows + R, and then done Ctrl + V. You don’t copy anything, it puts it in your clipboard automatically and you opened run and pasted the command. I can tell you that you did that because you got the virus and we can see the webpage lol.
Not saying this to be mean, but it'll happen again if you don't understand what you're doing, so that's why I explained what each step was and why.
I believe They use command to get your web season token. just go to every site press logout of every device.
btw, the only way to make sure noting is still on your pc is do fresh install.
No, not enough. by delete site session token that stored browser storage it just only remove the token from your browser, but it doesn't invalidate a stolen token on the website side. hacker still can use stolen to access your data unless you make that token invalid by log out of all device.
Instead of deleting your cookies, you could like logout of the site to invalid it. BUT this mostly works against like if you executed a code in console in inspect element. That virus the guy ran probably also stold his login credentials
Reddit did change something for me where it broke it for a few comments and then it fixed itself again (seems like reddit is inserting the backslash to escape your > by itself)
In the web version, Reddit has two text modes: Markdown and Rich Edit.
In the Markdown mode, you can use regular Markdown formatting syntax: * for italics or bold text, > for quotes, etc.
In the Rich Edit mode, all characters you type in are preserved as they are.
Rich Edit mode is the default, and the comment box should have a button which puts you in the Markdown mode (there's also a section in the account settings where you choose the default mode).
In Reddit's mobile app, all text is always interpreted as Markdown (though I haven't updated the app in a long time, maybe it also has the Rich Edit mode now).
I think they only compromised the accounts where I forgot to activate 2FA, like Steam, the Gmail account linked to it, and Instagram. Everything else seems to be secured at the moment.
My question is: can I reinstall Windows using only the tools built into Windows, without needing another PC? And after reinstalling, can I safely transfer my current work files to the new Windows installation?
How are the only compromised accounts ones without 2FA ? I got hacked some time ago and all of my accounts had 2FA for sure. I don't get how they do that...
yes. but modern site there should be a button that said something like " log out form all device. " somewhere in account setting. by press that it it will display Log out from all device Yes / No.
if you press Yes it will logged out from all device in 1 click include the device you are using it right now too.
If you want to reinstall windows, you might as well just switch to linux and then you will not have to worry about this as much and you won't have to deal with the countless problems with windows
If I'm not mistaken, these sites only steal tokens and cookies; basically, anything logged in on your PC is accessible to a hacker. Change your passwords and be happy.
Since I don't have the code that was executed, I can't know if it downloaded and run anything on your computer. Ideally, when you don't know, you should format your computer. Especially if you have nothing to lose. However, these social engineering schemes usually only steal your credentials (Tokens) and can steal them, sell them, or deceive other people. If you can and are unsure, formatting might be recommended, but since these Social Engineering attacks usually only focus on stealing data, I believe you're safe. If you don't want to format, there are a few things you can do. First, check the programs that start up on your PC; if anything seems strange, disable them. Another good thing to check is if the "virus" hasn't blacklisted the affected folder; I recommend checking the "ignored folders" in your antivirus software.Another thing you can do, and check if there's anything strange running in the background in the task manager, is to look at the Task Scheduler to see if there are any rules to run tasks again.
I have got an infostealer weeks ago on my Android and I think it is recommended to format your device just to be sure that you're good, but this is not easy at all since you said that you have lots of important files that cannot be erased. The solution to this is to move all of your important files to a hard drive and format. This way you get to keep your important stuff and rest easy.
Request help with FRST and SecurityCheck from the trusted helper team
Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.
If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:
From a different and clean device, change all your passwords:
Disconnect right away from the Internet. From a non infected device change all your passwords and 2FA. Do not reuse old passwords or keep using the same passwords for everything. Temporarily freeze your credit
Hey guys i got the same hack, idk it was smooth tbvh, they got into my LinkedIn, gmail, steam, insta, discord like everything i have store my sessions on the browser. So i made a fresh start by formatting all the data and rebooting new windows 10 but still the virus persists. In windows defender i found only one instance of it. So went into the safe mode and deleted the virus, from then its just multiplying itself in different locations idk what to do whenever i turn on the pc this freaking thing start giving birth and the best part defender cant treat it. It my third day and im so much done with struggle. Any help would work :(
Change your passwords on a different device and log out on this PC then reinstall Windows by using a clean USB stick and booting it from there through the bios not in Windows, also you will need a second device to load windows onto that USB stick
Afterwards download Malwarebytes and Bitdefender and scan your PC
Also it's good to get windows 11 since 10 isn't going to get major updates no more
There’s nothing “smooth” about this. You consciously opened a command prompt by yourself. Big red flag number one. You then consciously pasted something you didn’t know what it was in said command prompt. Big ol’ red flag number two. Then without further regard, you pressed enter to run that command.
It’s like a passenger in your car tells you to hit the gas full throttle, blindfold yourself, and steer into a wall, saying “all will be fine”.
I just fell for this from a fake Captcha on a normal website at 1:00 Am. Did it on my Macbook in less than 15 seconds without thinking because I was hurrying. Not a complete novice at either. I’m used to being less attentive on Mac unlike my PC so was not thinking. Shit is absolutely possible and extremely fucked up. Don’t think I have ever needed to open terminal before.
Oh, it’s possible, but just not “smooth” in the slightest. When you have to perform weird tasks you normally never do, not just on your computer but also in other real life situations, an alarm bell should start ringing.
87
u/wannabe_chatur Sep 10 '26
wait so you copy pasted a prompt in cmd from the website?