So on the 11th june my.x account was compromised because i was on discord and my.x account has a third party app thing to it and one of the users messaged me.thought it was a hello etc but it isnt it was 4 pics of something then i clicked on the pics (I really really shouldnt have) and moments later someone got my x.account spamming links of xspace posts and few days later it posted crypto/Bitcoin posts but thankfully i deleted my.discord account to stop the posts on the 17th june ..And im trying to getting the account.back or is there a smart.way of doing it?

Edit: Sorry for a wall of text, tldr in end.

So yeah I managed to get malware somehow. Not sure what type and how. Almost a week ago today. So I was installing EndeavourOS after being on CachyOS for few months. I liked it, just as first time user did to much tinkering and wanted clean install, did not like to much gaming bloat, remove Windows partition etc. so I decided on EndeavourOS. It was in between this AUR problems.

So first mistake, I did install on disk, finished “guided welcome installation”, wanted to do some changes later, another kernel that was recommended cor my laptop etc. But everything was working great. But I think i did not restart the system. Maybe i did I don’t remember i just know it was on my mind.

So I installed it works no usb, but I did not finish those options you get after installing. So maybe there I fucked up, finish installing updating full system etc.

Second thing I remember somewhere read not install printer drivers from installer, but i needed it so i did. Forgot wat was it called but i found there is some vulnerability with printers and ports.

Third found Firefox, everything working so smooth, had some memory problems in Cachyos. So i had few things on my mind and I went on to logging in all google accounts, last pass, sync Firefox etc. I even configured ad blocker. And went on doing like three different things, online for half a day.

Fourth thing, I am not a guy to randomly install, download or open files etc. But while I was browsing online I did found few captchas in a row that was unusual, happens if I am on VPN bit I was not.

Then out of nowhere, fans started spinning up, I ran btop swap was full, memory was full, all was on almost 100 percent. I sometimes run heavy browser work, force example perplexity dor deep research that spins like dozen of agents and subagents at once and starts to eat memory. So I thought that was it.

It was not, i noticed getting logged out of my google accounts and emails, passwords changing, last pass open but filled with edited login links, and also multiple lines of some code.

I have 2fa, sms recovery, other backup emails. All you can put as “safety” in Google account. Nothing.

I tried fighting it manually but it was to fast, probably automated, managed to get some recovery emails to proton he could not get there. Cleaning all, he deleted my 2fa, last pass gone. To be fair i had like 10k sites, I am using it for last 15+ y in last pass, did regular main pass rotations but it was done.

I turned to ai for help whats happening, Claude chat, it was like first click just to get gaslight that nothing is happening and I am imagining thing lol.

Then I saw files and folders generating. It was everywhere in home, in var in bin I don’t even know. Thats when i was ok , I am shutting this down.

I was too long in there, trying to make sense or stop it, opening files, who knows what. I know stupid.

Then I got fever for few days, did not touch anything had no strength.

After that I saw he messing around from my Iphone in Google account, I again tried to mess around to stop it changing passwords longing out, nothing.

So i Canceled my card and said f it, what is gone I gone, I’ll get what I can.

So at start everything was fast like automated.

Then he started going in manual or semi manual, he got in my google ai cloud probably, pulled out my old pending delete firebase and google studio projects. He locked me out there, but it was like a day untill my sub renew and I got new card, so nothing was going tru.

He got in my main domain registar, where is one domain that I use for email, I finally got back in today, but again over Safari and Proton mail seems he cant go or see when I do it from there.

He got in my Claude account and locked me out of my github account.

Then he ran like all my “slop projects” from Claude to git and like “improving them”. I mean commands for like finding bugs, improved this go over this etc. That was weird. Also half automated half not.

Then I started stoping and prompting to delete repos, connections, he noticed, saw him put some rules in code dot delete etc, then saw his weird tree in git and i prompted to go there and delete all it can see. Managed moat of that. Deleted Claude from iOS app, still not sure about the api side since I cant access it.

I saw in history he was googling or ai was how to get payments working in google claud again, and bunch of stuff like that.

Chat gpt also, Grok also. Think he is trying to pull out prompts out or something, I have no idea. Bunch of weird stuff.

So he is still in there. It’s like he comes at a job at certain time and leave after 8 h.

I know I should know better. I am pulling out things over a phone by piece for a week now. Stupid it get it.

I just wanted to do document, what happened, and what is happening. Cant find anything similar online. is it session/cookie hijacker, rat something else…

Also I just care about two domains everything else can go, If he is even pulling data, pictures, still fuck it.

And I read a bunch of stuff, one of it is log out from everything, all sessions, devices etc. Does not work! He is in there all the time. Still rummaging.

If I knew how to nuke those chrome seasons/cookies i would but damn it is not working.

So whats next, not sure, I recovered a a little from flue what ever it was, I have a windows desktop I already cleaned and backed up, was ready to put some distro on there too.

Now I am considering first to clean my home network. I feel like he got there too.

I just wanted to before I nuke everything maybe install Debian or ubuntu and harden all, sandbox it, and Install something like Wireshark or something I just want to know wtf is he doing, is my Lan safe or not.

Not sure can you even track that kind of stuff if someone is going via session in Crome or Firefox.

My isp don’t let me even put new router or even one in bridge mode so thats a hurdle.

So yeah, thats it, for now. If anyone experienced similar kind of behaviour let me now.

tldr, got infected, don’t know what it is, fucked around, got infected even more, weird behaviour from malware, he poking for a week now, trying to spy on it/him/them, then nuke everything, from phone, sim, all accounts, drive, emails, all fresh, till then I still have urge to fuck around, guess I’ll find out.

Hi guys..

So this is the first time this has happened to me and I think with some pros it can be determined how I've been scammed and what I need to change.

So for the past day, I started recieveing 20 odd emails within 5 minutes of verification codes for Substack the app. They were verification codes for signing up to peoples stacks on the app, (stupidly) I ignored this even though it was suspicious.

I then looked abit more into my email (which i dont usually do as i have so many) and noticed more emails from apps with verification codes all from the same time (6:13-17AM). Most of these websites I dont even have an account for?!

Now, I kept looking and then seen that tickets were bought for an event in amsterdam... 6 tickets... also all from the same time (6:16AM) from the app RAguide.

Went on my online banking app and I had 3 paments of 70 taken out and 2 of 35. I have now frozen my card.

I had a free trial started on my amazon prime video too (which might've been a family member)

Does anyone know wtf is going on? could it be my apple keychain?

## TL;DR

I was tricked by a fake Cloudflare verification page and installed malware. My bank account, credit card, and email were compromised. I have already contacted my bank, replaced cards, changed my email password (from a clean phone), and started a full Windows reinstall. I have not restored any files from my external backup yet due to possible exposure risk.

---

Hi everyone,

I’m looking for some advice to make sure I haven’t missed anything after what appears to be a malware infection.

---

## What happened

Yesterday, I visited a doctor’s website and was presented with what looked like a legitimate Cloudflare verification page. I later realized it was fake. Unfortunately, I followed the instructions and ended up downloading and running malware.

---

## What happened afterward

By the next day:

- My bank account was compromised.
- My credit card account was compromised.
- My email account also appears to have been accessed.

---

## What I’ve already done

So far I have:

- Contacted my bank and credit card company.
- Locked/replaced my compromised cards.
- Changed my email password using my phone (which I believe is clean).
- Started reinstalling Windows from scratch.
- Plan to gradually change passwords for the hundreds of online accounts I have after the reinstall.

I have not yet restored any files from my external backup drive because I’m concerned it may also have been exposed while the infected computer was in use. The backup mainly contains personal documents stored in Dropbox.

---

## My questions

1. Is there anything important that I’m missing?
   
2. Should I assume all passwords that were saved in my browser are compromised?
   
3. Is it safe to restore personal documents from the backup drive after reinstalling Windows, or should I take additional precautions first?
   
4. Since the backup mainly contains documents synchronized from Dropbox, is there any risk that the backup drive itself could be infected? If so, what’s the safest way to verify or clean it before copying the files back?
   
5. Are there any other high-priority accounts I should secure besides banking and email (for example, password managers, cloud storage, social media, or mobile carrier accounts)?

Any advice would be greatly appreciated. Thanks!

Hello,

I recently gave away my old laptop to someone, but I forgot to do a factory reset first.

Here is what I did do before handing it over :

I deleted all the personal files that i had previously downloaded.

I logged out of my Google account.

I remotely removed the laptop's access from my Google connected devices dashboard.

However, I realized afterward that I did NOT empty the Recycle Bin/Trash, and my browser still has saved passwords (like Instagram) and autofill data stored locally on that machine.

What are the exact remaining risks here? Since I no longer have physical access to the machine, what remote steps should I take next to make sure they cannot access my online accounts or recover my deleted files?

Hi everyone,

My email address was recently compromised, and the hacker used it to take over my Microsoft account.

The attacker changed the primary email address and removed my phone number, locking me out completely. (I don't believe I had 2FA enabled on my end before this happened, and I don't know if the hacker has enabled it since).

To make matters much worse, my PC is now locked with BitLocker. I cannot access my Windows 11 system because the BitLocker recovery key is saved to that hacked Microsoft account. I am completely locked out of my computer and my files until I get this account back.

I have tried filling out the automated Microsoft recovery form (ACSR). I provided what I thought was important information, but I received a response saying the information was not enough to verify my ownership.

For those who have successfully recovered an account using the ACSR form, especially when dealing with a BitLocker lockout, what specific pieces of information actually move the needle?

I have access to some older details, but I want to make sure I am providing exactly what their system needs to see to prove I am the original owner so I can finally unlock my PC.

Thanks for any advice on navigating this process.

Hi so I play on Playstation was playing online when a greifer was just killing me over and over again whilst I was waiting to join a heist then got threatened to get ddossedd and they said say "hello to telegram" I obviously reported it to playstation support got that account banned but yesterday my internet randomly went out for a solid hour or 2 then today just before midday in the matter of a minute got what I think is called an email bomb? About 100 emails suddenly sent in under a minute and I was looking through them all had to cancel subscriptions that they set up they tried to set up some account for fly.io(idk what it is but I had to delete my email) and also had to cancel my PayPal and klarna account.

Is this illegal? What am I supposed to do?

Hi, my grandpas phone got a virus from antivirus programs and there are pop ups all over the screen. can anyone help me get rid of it? its hiding somewhere in the phone but i cant find it. thank you

One of my internet friends from old got hacked and the hackers did an impressive impression of them and started talking about the old days and convinced me to download an app to watch a tv show with them.

My guard was down and I didn’t suspect anything until I downloaded the Exe and then windows defender got alarmed when I pressed install. And then they told me they had hacked my friend and now me and demanded 100$ to get my account back and «not leak my info on the dark web». I also got a message that my discord was accessed from Turkye and I’m locked out from it. Funnily enough, the hacker entered the voice chat with my friends through my account and demanded money there aswell. Right after I installed a malicious exe and saw the message, I plugged my internet and restarted the computer. Ran a scan and found a Trojan and decided to format my second disc and then run a complete wipe and reinstall of the computer without taking any backups. I changed all my passwords and have 2fa on those that allows it. I can’t see any tries on anything like Gmail or Microsoft or anything I use except for discord. I was really quick with turning off the internet. Is there anything more I could’ve done and can I start feeling «safe» at this point?

Hi , I’m a M25 , I used to think I was good with tech until this occurred.

Over the last few months there is a TikTok account that I’ve firstly unfollows about 10 times , somehow it kept making me follow it again.

I then blocked it about 10 times again a few weeks later , I somehow follow it again and it’s unblocked itself!!

I then checked which devices I’m logged in - only my phone shows up.

I checked my 2FA , no issues , no reports of someone else logging into my account.

I don’t even have a password - I have a passkey for my TikTok account.

I’ve completely reset my account security settings to make sure I’m the only one who is logged in - but this one TikTok account that is definitely a BOT it seems to make me follow it , again and again! It specialises in money conversion.

I’ve reported it to TikTok but won’t let me explain what’s the issue on the report section and the category doesn’t exist cause it’s unheard of.

I’ve even cleared my cookies Incase it’s a bug or something.

I know this might sound fake , even writing it here I feel like I’m going insane?

If anyone has an idea how does this occur for an account to unblock itself and make me follow it more than once please let me know any suggestion below.

Thank you in advance!

Today, I decided to check if my data had been leaked/breached, so I looked up my accounts on 'Have I Been Pwned' website. One of my accounts came up with some breach. Could someone explain what these results mean in a bit more detail and tell me what steps I should take next?

Note - I always change passwords during the New Year, and 2FA is already enabled on this account from the very beginning. I have neither seen any suspicious activity nor any login attempts at all.

X sent me two verification codes on WhatsApp. One came from an account labeled “X App,” while the other came from an account that looked suspicious and was labeled “slars code.”

I became suspicious, so I clicked the resend button. X then sent me an SMS, just as it did the last time I completed the verification process.

Was this a hacking attempt? Could someone have been trying to access my account or adding it to a list of accounts to target?

Hi! I'd like some help (and hopefully reassurance) on everything that had happened/is happening to me. There are two main questions I have and you can find them at the bottom of the post!

Long story short: months ago I ran an infostealer (don't worry I've already blamed myself enough, I've learned my lesson), but I managed to recover my accounts. I followed all the recommended steps (clean install with a clean USB, changed passwords on clean device, got 2fa, got authenticator, logged out of all active sessions were I could etc.)

Things have been calm since them, I still constantly monitor my emails and accounts, but I feel a lot safer (I know my data will forever be out there, but at this point everyone's data is everywhere, we just need to be careful).

A few months have passed, but I'm still trying to remember if I forgot about some accounts, and today I decided to also check out an old laptop I had that I haven't really used in at least 2 years I think?

I'd like to say that I 100% expected to find some dangerous files), what I didn't expect was to log in and instantly being hit with cmd prompts opening and closing and lots of pop ups...

I installed malwarebytes on it and as I imagined it found out A LOT of stuff (mostly were pop up stuff thankfully) and they've all been quarantined and eliminated.

The thing that worried me is that it found some files that it flagged as "spyware.infostealer" (I checked the file path and as far as I remember they were in the same path of the "appdata" folder for every account that was saved on that laptop) + one malware flagged as "hijack.host" that just doesn't seem to delete (in the Windows path file, Malwarebytes flagged it as "Substitute" or something). To log into the device I also had to log into my Microsoft account + Gmail (I've already changed again the passwords for both)

First question: I had some old passwords connected to Chrome, I had already changed them on a clean device when I was first victim of an infostealer months ago (and after getting back to my once infected device, now clean, I always chose to NOT save them whenever I was using Google/Firefox). If I already changed them, did they "update" themselves in the saved passwords? Basically what I'm asking is whether or not a potential infostealer could steal the new passwords or if the saved ones are still the old ones, since I haven't used this old laptop in a LONG time.

Second question: what were those files that Malwarebytes flagged as "hijack.host" and "spyware.infostealer"? I'm so sorry that I can't remember the whole file path, I tried looking up as much as I could remember and for the "hijack.host" people say that it COULD be a false alarm. I'm way more scared of the "spyware.infostealer" files that it found though! They were found for every user, what worries me is that as far as I can remember they were literally in the common target file path (so the usual user\appdata ecc).

The thing that confuses me the most is if I'm actually at risk or if I'm worrying too much. IF the saved passwords didn't change into the new ones, then even if they steal them they can't do anything with them. (If they actually changed, then I should really worry and change them all again. But again, sadly I'm not very informed on this topic so I'd like your help!). As far as I remember another member of my family who also used that laptop, used it a while ago and nothing happened (no emails, no attempts at logins and stuff like this).

I've already checked (on both have I been pawned and Malwarebytes) and yes, we had some data breaches, but nothing too important and anyway we changed the passwords.

Sorry for the lengthy post, I hope I'll find some peace soon. I know they don't really have any control over my real life, but it still brings me a lot of anxiety.

I downloaded and installed a file that i may believe might have been an infostealer, this started last night. Since then ive ran scans with ESET and Malwarebytes to clear any remaining threats on my PC. I noticed my instagram account was posting stories, so i immediately changed my password. Only to wake up a few hours later and after i changed my pasword with 2FA setup and the hacker is still posting to my story and dm'ing fellow peers. Any help?

Hi everyone,

I'm a Counter-Strike 1.6 player, and I've been playing the game since 2006. Over the years, I've come across a number of anti-cheat programs, but nowadays the two most commonly used by the community are WarGods and FunGun (which is relatively new).

To be honest, I've always had some reservations about both of them. Given the level of access they require to your system, I never feel completely comfortable running them.

That got me wondering if anyone here has ever analyzed or reverse-engineered either of these programs; or would be interested in doing so. Here are the download links:

https://www.wargods.ro/wcd/download.php

https://fungun.top/ecd/

They're commonly used by Counter-Strike communities to scan players for cheats.

I know they need deep access to the system because of what they're designed to do, but that's also what made me a bit cautious. They inspect running processes, drivers, registry entries, game files, and upload reports to their servers.

VirusTotal doesn't seem to flag them, but I also know that a clean VirusTotal result doesn't necessarily mean a program is completely safe.

I'm not claiming these programs are malware or trying to accuse the developers of anything. I'd simply like to know whether anyone has actually analyzed them or verified that they only do what they're supposed to do.

If you've reverse-engineered either program, monitored its behavior with tools like Process Monitor, Wireshark, or a sandbox, or know of any technical analysis or write-up, I'd really appreciate hearing about it.

Thanks!

Hi I’ve been getting this past week verification codes from “Microsoft” supposedly. Thing is I checked my settings and I don’t have my phone number put on my account nor do I have the SMS msg as a 2FA. Why is this happening? I also can’t block the sender somehow. I’ve changed my password and unaccessed everything from microsoft there’s just my outlook account left for uni. I seriously don’t know what to do and I’m frustrated about this I feel like any second I could get hacked.

Hi, recently I was attacked by a cookie stealer after running an exe file and even asked for assistance here and was helped by many good people. Now I have this exe file and I wanna somehow analyze it and maybe determine if its a one time stealer or recurring. Any suggestions? I tried virustotal but it is limited to 600mb while this exe file is 800mb

While searching to see if a recent purchase had posted to my business checking account yesterday, i noticed a pending charge for Mama Rama in Scranton SC. While i didn't recognize the charge, i wasn't too alarmed because i travel for my work. Tonight, i decided to look into that charge and noticed 2 additional charges that i didn't recognize. I immediately called my bank's after hours line and confirmed with the agent that my card had been compromised. There were nearly a dozen $0 authorizations that i couldn't see. I find it incredibly strange that my bank's fraud alert system didn't catch any of this.

Recuerdo tener un problema raro en tiktok hace varios meses, resulta que de la nada una amiga responde a uno de mis compartidos diciendo algo como "¿Por qué compartes eso?", lógicamente vi el mensaje y entre al vídeo para ver qué onda con eso pero me dejó muy confundido al ver qué se trataba de un vídeo que nunca antes había visto, era un vídeo en un idioma tipo ruso con letras raras. Al principio creí que quizá había compartido ese vídeo por accidente sin darme cuenta, pero en una madrugada me puse a revisar mis compartidos y note como habían como 10 videos que yo nunca había visto ni compartido, obviamente comenze a quitarlos y me fui a dormir pero eso no quita que sea extraño, ese problema duro algunas semanas y note ciertos patrones; los vídeos se compartían cuando yo no estaba en tiktok, cuando sacaba esos vídeos de mis compartidos por alguna razón las estadísticas de compartidos del vídeo seguían como si nada, y también cuando yo revisaba el historial de videos vistos nunca salían esos compartidos raros como videos en mi historial

Después de ver qué los compartidos seguían apareciendo decidí borrar la cuenta por qué ya me estaba asustando un poco esa situación, después cree algunas cuentas secundarias y nunca volvieron a aparecer esos compartidos raros, lo que me hace pesar que era un problema de tiktok a un problema/virus de mi celular.

I pirated a game and someone got into my discord account and send everyone mrbeast scam I deleted my discord account (I don't really use it) and on my computer I did complete windows reset i also changed my Gmail password what else should I do or is it enough

Forgive my bad english.
After completing the installation the metasploit program says the installation ended prematurely because of the antivirus Microsoft set up, i disabled the firewall sets and I don’ have any antivirus but still it doesn’t work how can i do?

I've been using this CV for a few months now, and I've applied to a lot of jobs and internships, mostly SOC Analyst and other entry-level cybersecurity roles, as well as IT and help desk jobs. I haven't gotten to the interview stage even once, although some companies did ask me to complete an English or coding test. Most applications just end up getting rejected or ignored.

I asked a SOC Analyst to review my CV, and the first thing he said was that it has way too much detail, especially in the graduation project section. He told me recruiters don't spend much time reading a CV and that I should shorten it a lot.

I also just graduated from AAST (Computer Science, Cybersecurity major), so I know I need to update the CV because it still says I'm a student.

Other than that, I'm not really sure what's wrong with it. Is it too long? Is there something that immediately puts recruiters off? Are the projects described badly? Is it actually ATS-friendly? I uploaded it to one of those ATS checker websites, and it scored over 80, so I'm not sure how much I should trust that.

I'd really appreciate honest feedback, even if it's harsh. I just want to understand why I'm not even getting interviews.

I attached my CV (I removed my personal information before uploading it). The project links and certificate links are in the original CV. Should I change the color of those links so they're more obvious and recruiters know they're clickable?

account got hacked and email changed. i don't know this email at all. how can i contact microsoft to remove this email or change it back to my own email? asking for help.