Info stealer malware

[u/Unbeatable61]

2 hours ago my IG and discord accounts both got hacked even though I have 2fa enabled on both and started sending dms to all my contacts by screenshots of the classic Mr beast giveaway scam, the thing is I never leaked my credentials nor put it on fishy websites, never downloaded suspicious software or pirated games....

I immediately logged out all my devices to clear the authenticated logged in sessions( there weren't any new devices or new suspicious logins detected, which makes sense on why I didn't get the 2fa notifications) currently running deep scan on my laptop after disconnecting it from the internet (not sure if the login sessions could be hacked on phone, but highly doubt it)

My main question is do I really need to change all my passwords for all logged in accounts on my laptop, or that was just a session hijack and the hacker didn't really get a grasp of my passwords? Also will I need to install new windows on my laptop?

[u/AutoModerator]

Request help with FRST and SecurityCheck from the trusted helper team

Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

1. From a different and clean device, change all your passwords:
   • How to properly secure my accounts after an infostealer attack?
2. Disinfect your device from malware
   • Preferred method: Perform a clean installation with a USB

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/polpolik2]

Did you perhaps fall for a fake-captcha or download mods that could have infected you?

If not, could it be that you re-use passwords, and that any of your accounts were in a leak? (you can check HaveIBeenPwned or HudsonRock as a check, but no guarantee that it's in there).

If you think you have an infostealer, this is what you should do:

Read this: Rifteyy_'s guide to infostealers to get a better understanding.

Reinstalling Windows to remove the malware.
The fastest and guaranteed way to get rid of the malware is to reinstall Windows, preferably from a USB created on a clean device. If that option is not available to you, you can also do a cloud reinstall while deleting all data.

If you’re only dealing with an infostealer, wiping your C drive is sufficient. However it’s better to do a full wipe and only back up your trusted Data files, as there could be more malware on your device that you’re not aware of.

FRST Assistance
If you do not want to reinstall windows you can wait here for one of the trusted helpers to assist you with FRST. Please read Receiving FRST assistance. Please follow these instructions carefully and provide the keywords. Doing so can get you help considerably faster!

What you can do immediately either during the reinstall, or if you're waiting for help:

1. Disconnect your infected PC from the internet.
2. Change ALL passwords from a clean device. Start with your emails and bank. Use sign out everywhere and remove all sessions. While you are doing this, check your security settings to ensure the attacker hasn't added their own 2FA methods or backup codes.
3. Check your linked accounts/services/2fa options for your most important accounts. Also check forwarding rules on your mail. Additionally, for your browser, check your sync settings and extensions and remove anything you dont recognize or trust.

The faster you move with these steps the more you can prevent your accounts being stolen! Make sure your clean device does not sync passwords through browser for example to your infected device.

[u/Unbeatable61 → u/polpolik2]

I kinda use similar or some identical passwords across certain accounts, but wouldn't a new login trigger the 2fa notification?

[u/polpolik2 → u/Unbeatable61]

If it was properly set up, then yes, 2FA should have protected you, which is why an infostealer infection is more likely.

But infostealers dont magically appear, which is why I asked for some other infection vector possibilities and gave you instructions how to deal with the malware if you suspect you might indeed have that.

[u/Unbeatable61 → u/polpolik2]

You are probably right, I might have actually done some fishy captcha, but I thought these "I'm not a robot" prompts are safe, how can these these captchas leak my logged in authenticated sessions?

[u/polpolik2 → u/Unbeatable61]

I am mostly referring to clickfix - in which to 'pass a verification'' you paste a command on your device which infects you. It happens when a site you visit is compromised and used to spread the malware.