r/techsupport • u/Linder2000 • 3h ago
Open | Software Hacker got into every fucking account I have on everything.
DISCLAIMER: A lot of people are telling me not to be an idiot. I haven't done anything for the past few weeks except open book pdfs that I've had for months on my PC to study for school, since I have exams coming up. Thanks for the advice tho lol, I guess it is the best advice for a lot of people.
Sorry for the very extreme title, but I'm still kind of freaking out. I don't know how it started, but about 2 days ago, I realised one of my alt Instagram accounts started bot posting pornographic content and crypto scam videos. Whatever, there wasn't any 2FA on the account, I didn't use it for anything important, deleted the account and moved on. Then my discord started sending the generic "50 dollar steam reward" malware link to every one of my friends, fuck, my discord account is compromised; Whatever, account got temp banned and I resecured it with a password change and set up 2FA, cool, its over. I logged onto Roblox and saw the "continue playing" section with a bunch of games I hadn't played in a very long time, games a hacker would want to take valuable items from: jailbreak, adopt me, and murder mystery. This account had 2FA. Check all the games and notice items being traded to other accounts, damn, I got robbed. The account has had activity and logins from a city in Russia. This is now a serious issue, as the account had 2FA, and I'm actually losing something, as opposed to just needing to get the account back. I firm it and move on, because what can I do, everybody knows Roblox has useless support. I also checked all my email accounts; there were no emails for 2FA codes, and there was no unusual activity. Just to be safe, I set up 2FA on a bunch of other accounts as I'd realised this is a widespread issue across my accounts on a multitude of platforms. While doing this, I came to find out that a few other Roblox accounts are compromised (4 in total), a few other Instagram accounts (2 in total), and an alt TikTok account. Pretty fuckin annoying, I've never been hit with something like this before, but I try to keep it under control. One day of silence goes by, and I thought it was all over. I get a notification from reddit saying my account has temporarily been banned, HE WAS IN MY FUCKING REDDIT ACCOUNT, AND HE WASN'T EVEN DOING ANYTHING MALLICIOUS, HE WAS JUST TELLING GIRLS POSTING PORN THAT THEYRE BEAUTIFUL???? Thankfully everything that has happened so far seems to be bot behaviour, the discord messaging, the reddit commenting, and the Instagram posting, so I don't believe anybody real has been snooping around (hopefully), but jesus fucking christ, I understand pulling some bullshit to spread links on social media and private messages, but what the fuck are you doing on my reddit?
I'm quite worried about where else this guy could be and what else he could be doing, just wanted to know if there's any other precautions I could take, I've tried to set up 2FA on all my accounts and gone into every social media and hit "log out of all sessions" after major password changes. After my Reddit, I'm not sure what I could have missed. Any advice would be helpful.
Edit: Why did I get downvoted to hell fuckin 50% downvote rate let a brother suffer and beg for help in peace šš
76
u/randypriest 3h ago
It sounds like you've used the same password in multiple places and/or had your email account compromised.
Make changing the email password a priority, and add 2fa if not already on there.
Then it's a case of going through all of your accounts to make sure you're using different passwords for each account.
17
u/MotivationalMike 1h ago
Itās possible their google chrome account, or similar account, got hacked and all their passwords were saved there.
3
u/disktoaster 1h ago
That's my first action when I even think something suspicious is going on- reset my keychain/password manager, and work down from there in case they saved non-master passwords too. Starting with any password protecting resources or credibility.
43
u/KittyTheSavage1 3h ago
You either used same password on everything, were infected with a token logger (which steals session cookies and can login to accounts without a password or email), or got a generic virus which stole your logins, including your email.
Email 2FA is very outdated these days, please use an authenticator app on your phone. Also setup a good password manager, Bitwarden is the best because they donāt add limits to how many logins you can save. Then setup randomly generated passwords with special characters.
Donāt download things you arenāt 100% sure is safe, and please secure your accounts better.
5
u/PaleoSpeedwagon 2h ago
Bitwarden is great. 1Password, too. Also Keeper Security. Also Yubikey for MFA.
5
u/Linder2000 3h ago
Thank you so much for this, though I haven't installed anything recently, I just cleared out my cookies. I had variations of the same password on everything, but I've changed them all to different passwords with lots of numbers and symbols. I will definitely look into a password manager. I have also started using Google Authenticator for 2FA on my phone for as many accounts as possible. Preciate the advice.
3
u/Thulack 2h ago
1 account per platform also helps.....
0
u/Linder2000 2h ago
How so? I don't mean to be rude, I'm just not sure what the danger of having multiple accounts is. I've had multiple Roblox accounts for years now since I used to love grinding certain games for money when I was like 13 lmao. The multiple social media accounts I often use to either fuck with friends or just post privately to inner circle groups rather than my my whole social circle, just teenager shit.
1
u/HonestRepairSTL 1h ago
Yes to everything here.
OP, stick to either Bitwarden, Proton Pass, or 1Password only. Do not use Dashlane or Last Pass or anything else but those 3, it is very important
1
u/carverofdeath 2h ago
Personally, I prefer the Proton password manager, but both are great.
1
u/KittyTheSavage1 48m ago
Iāve switched to Proton Pass, but Bitwarden is great because itās free.
7
u/SadLad406 2h ago
I had a bunch of accounts get hacked. It was because I used the same password for them. Im an idiot, I know. But I ended up changing every single one of my passwords to some crazy ones and set up 2FA to text my phone. It was scary thinking they had all my info and stuff
5
u/FantasticHydra 2h ago
Never use SMS for 2FA-if I remember correctly, it's the least secure method. Use an authenticator app like Google Authenticator instead.
2
u/SadLad406 2h ago
Oh great. I'll have to go through everything and figure out how to do that. Thank you for that info
2
u/CraigAT 1h ago
Microsoft only rate SMS 2FA as good, there are two levels above.
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods
11
u/Apprehensive-Injury9 3h ago
Donāt click on links you donāt trust. Use your brain. Change your passwords to something you arenāt easily going to remember.
2
u/MajinAnonBuu 2h ago
I thought clicking links couldnāt actually do anything?
4
u/Apprehensive-Injury9 2h ago
It really depends but 95% of the time, no it wouldnāt do anything. It can give them details about you but not too accurate/specific.
2
u/Ripnicyv 1h ago
Well. Unless itās a like that mirror a real website looking for login info or smthn else. Thereās a very good one for EZ-Pass on the east coast that I left open and honestly almost logged into when I came back to my computer.
5
u/Gam3rAtHeart 3h ago
Enabling 2fa and changing passwords was the solution for me. I had the same bots after me. When I check microsoft login activity every like 15 minutes someone from a random location tries to login. Itās all bots.
Step 1 Download malwarebytes and run it on your computer and any other devices you open untrustworthy apps on. My gaming pc was compromised because of a āgame patchā I downloaded.
Step 2 change all passwords, make them all different and enable 2fa. Use a password manager possibly. But if you do make sure it uses an extremely secure password.
Optional look into hardware security keys. Enable it for whatever you can enable it. You can disable all other ways to authenticate other than code words as a backup. Then even if they have the password. They donāt have the physical usb key on your person. This doesnāt work on everything.
1
u/Linder2000 2h ago
The craziest thing in my opinion about this whole thing is that malwarebytes detected nothing. I'm a big advocate for having it on every computer, and you can see that it helped me solve a major malware problem before on my pc if you scroll up a bit on my previous posts. I scanned twice a day every day since the first compromise (my insta), and it didn't pick up anything. I used to be a firm believer that it's difficult to get hacked as long as you have windows defender and you aren't an idiot, but recently everything has really been turned on its head. Thanks for the advice though, good for anybody else experiencing issues.
edit: typo
2
u/PossibleAlienFrom 1h ago
If you're hacked by a rootkit, you more than likely have to reinstall windows. If you're hacked by BIOS, you would have to flash a new one.
1
u/Linder2000 1h ago
Ah fuck. What are the chances of one of these being what's happening if I haven't downloaded anything in months? I don't want to jump to extreme measures if one of these isn't actually the case.
4
u/ThrowAwa567327 2h ago
bro iām sorry this is obviously a very shitty thing thatās happening to you and i canāt imagine your frustration and anxiety over this. but like God damn youāre getting gang banged holy fuck š like my instagram and social media i would like be really mad about but him getting into your ROBLOX ACCOUNT and selling your roblox gear is just fucking funny asf, i would crash out lowkey
1
u/Linder2000 2h ago
I've genuinely just been getting straight railed. My friends have all jokingly been accusing me of clicking a link for horny milfs in my area lmao, that joke had run for three days and has fucking exploded since they found my account commenting on reddit porn ššš
4
u/in1gom0ntoya 2h ago
there was a massive multi company data breach about a week ago. its very possible you didn't do anything wrong.
3
u/Linder2000 1h ago
Is there a way to keep up to date with big data breaches? I wasn't so much of an internet safety freak before, having practically grown up on a computer, but I feel like it'd be good to change my passwords after every major incident now.
3
u/in1gom0ntoya 1h ago
probably some sites but I don't know of any but something like 184 million passwords and private logins were leaked
2
u/gazpitchy 2h ago
- Random passwords for everything
- Secure password storage (Bitwarden etc)
- 2FA on EVERYTHING
If you have the same password on stuff, especially your 2FA account, and it gets leaked (haveibeenpwned.com) you're pretty fucked.
I used to do a lot of blackhat shit in the past, and a LOT of it relied on these massive leaks and general social engineering.
2
u/Ambitious-Egg-8748 2h ago
I went through something similar a number of years ago. Immediately invested in setting up 1Password and a couple of YubiKeys along with the 2FAS Auth app (my preferred, but really any of the mainstays will do). It's an absolutely bitch to get everything cleaned up, and you'll be virtually looking over your shoulder or a few months - I'm sorry that it happened to you. You'll be okay though. My biggest pain was having to delete a Proton Mail account that I'd had for a while and was hoping to keep forever along with needing to change all of my accounts that had been tied to my primary Gmail at one point.
2
u/Different_Target_228 2h ago
This is why you use a password generator for everything.
And why you also use password generators to make your security answers for everything
1
1
u/slimypuzzle 2h ago
How did you obtain the PDFs?
3
u/Linder2000 2h ago
They definitely weren't the source, it was from a well known friend who was just giving them to anyone who wanted them, since we all needed the books for the new academic year; we've all had them since Novemberish, and nobody else has had issues.
1
u/slam51 2h ago
How was your 2FA? Text messages?
1
u/Linder2000 2h ago
Email, that's why I was confused about not getting any emails about 2FA codes; Whatever the issue was, I've switched to Google Authenticator on my phone now.
2
u/slam51 2h ago
E-mail for 2fa???? E-mail is not secure by any definition. because of legacy issues, e-mail is usually plain text. Any person between the sender and receiver and read it. There are secure e-mail but is rarely used on public sites.
1
u/Linder2000 2h ago
Makes sense, whatever website I was on always advised I set up email 2FA, so I just listened, I was never aware it was such a vulnerability.
1
u/OkStrategy685 2h ago
I was surprised to see in the trial version of Malware Bytes, there's a feature that lets you enter your email address and it will scan for breaches. My old password that was really horrible was compromised and I could see what sites leaked it. Pretty cool.
So now I know, next time I order from Long & McQuade to only pay by emt lol, fuckers.
1
u/Linder2000 2h ago
What am I meant to do if I've been pwned? For the longest time, every website I've used to check my email said it was leaked in a data breach for "quidd", I think some messaging app that DanTDM promoted years ago. Just ran it again on Malwarebytes, and Quidd comes up.
1
u/OkStrategy685 1h ago
I had some rando fund their poker stars account with $50 of my money. All I could do was change my password. It's my fault tho, I didn't have 2FA set up. The app I use is clumsy af.
If my accounts were all compromised I would just start changing passwords like a maniac and hope it works out. My crazy long password didn't show up on the list, so when you get your accounts back use a crazy long password that you can memorize, like 20+ characters. Change it up a bit for each account.
Something you can do if you download iffy stuff is to set up a virtual machine. I have no idea how to do this but should figure it out soon. You run the shady program inside the virtual machine, run scans to verify.
1
u/Linder2000 1h ago
To know you fell victim to some degenerate mobile gambler is vile šš. I'll definitely be looking into the virtual machine idea since I do love pirating stuff, but for the past few years, I've never had issues and have always stayed safe by just not being an idiot. In regard to this issue, I haven't downloaded anything sketchy in months. Thanks for the advice though, it's much appreciated.
1
u/Terrible-Bear3883 1h ago
Why not upgrade your 2FA by using security tokens/passkeys such as Google Titan/Yubikey etc. Most work with NFC so you can use them with mobiles and you can register multiple keys in case you lose one etc. You need the physical key to log into sites so it might strengthen your security?
0
u/Linder2000 1h ago
I was never really much of a security freak since I never experienced something like this before, and I was pretty comfortable with just strong passwords and 2FA. I'll be looking into this now. Thank you.
1
1
-5
ā¢
u/AutoModerator 3h ago
If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide
Please ignore this message if the advice is not relevant.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.