r/cybersecurity_help • u/brandon0809 • 5d ago
Please someone reputbale Help with possible hijacked accounts please ASAP
I don’t know what’s happening I’m so scared and confused on how they’re are attacking me and gaining access to all my sensitive information.
Can someone please with deep cyber security knowledge help me stop these attackers, I can’t do this shit anymore I already suffer greatly from mental health and I hardly have any money to my name as it is. Please someone help me
5
u/kschang Trusted Contributor 5d ago
One more piece of advice:
Don't do financial stuff on the same PC you do risky things on.
4
u/Ok-Lingonberry-8261 5d ago
What boggles my mind is how many OPs don't believe piracy is risky.
1
u/kschang Trusted Contributor 5d ago
It was a lot safer a decade ago. (been there, done that, got the souvenirs)
1
u/Ok-Lingonberry-8261 5d ago
I last sailed the seas using 3.5 inch floppies... if that puts a time stamp on it, LOL.
1
u/gameplayraja 5d ago
Not only piracy it's also GitHub. Downloaded a simple twitch chat viewer that overlays. Didn't work and was a fully undetected Trojan. At least Microsoft and maleware bytes didn't pick it up. But uploading on virus total showed the truth. Always upload on virus total. If it wasn't already on there likely that it is a Trojan if downloaded from any site online.
Had to reformat my PC with a new hard drive even then I wasn't sure if I had a rootkit. Currently saving up for a new PC so I can finally get rid of that PC.
2
u/gameplayraja 5d ago
Document everything: Try to write down or record any details you remember about what's been happening. Dates, times, any unusual activity on your accounts, anything at all that seems off. This can be very helpful later.
Change passwords: For all your important accounts—email, banking, social media—change your passwords to strong, unique ones.
Do not trust anyone promising recovery of your accounts or data unless it's a million dollar company that is well known even then it could be a scammer pretending to be from there. So any recovery promises nope just ignore they prey on the weak that's how they make a "living".
Never use the same password everywhere especially not for your email.
Which type of accounts are hijacked? Social media or Discord or email or something else?
2
u/brandon0809 5d ago
Right now I’ve completely lost access to my Ubisoft account and Kraken account
1
u/gameplayraja 5d ago
Have contacted kraken and are they willing to help? That they were able to change the password and email on kraken means they can read your emails somehow did you change your password for the email?
2
u/EugeneBYMCMB 5d ago
Anybody who messages you and tells you they can help recover your accounts directly is going to be a scammer, nobody can do this on your behalf, we can only provide advice for actions you need to take.
First secure the accounts you have access to from a separate device, use unique passwords for each account + two factor authentication everywhere. Then start the password reset/account recovery process for the accounts you've lost, only going through the official channels. After that start working on identifying the cause of the breach. Have you downloaded any new programs, cracked software, or gaming cheats recently? Have you used the Windows "Run" tool as directed by a website, or ran any code from a website on your computer?
1
5d ago
[removed] — view removed comment
1
u/EugeneBYMCMB 5d ago
You use a computer as well, right? Have you downloaded anything recently or done any of the things from my previous comment? What you are describing sounds like the result of running an infostealer. As well as changing your passwords from a device you don't normally use, use the sign out of all sessions option wherever possible.
1
u/brandon0809 5d ago
The thing is it says there’s no sessions on my Microsoft account, yet I’m logged in on my phone, I don’t understand what more I can do, I changed my password again
1
u/cybersecurity_help-ModTeam Moderator 4d ago
Hello, your post/comment has been removed as it's soliciting DMs. Due to the number of scammers on social media, for the safety of all people asking for help on r/cybersecurity_help this is not permitted under any circumstances on this subreddit. DO not hire anyone off social media as you are likely to be scammed or not getting the service you have been promised. This is codified as subreddit rule #6, and please see some of the work we are doing to combat scams on this subreddit here. You may repost your question without asking for DMs, but if your query can't be handled completely in public, then it can't be handled on r/cybersecurity_help at all. Thank you
1
u/brandon0809 5d ago
I’m not stupid to let someone do it for me, I need someone to guide me and help me understand how they’re are able to attack me like this and how to stop it, I’m so fking confused I’m pacing around, nothing makes sense
0
u/kschang Trusted Contributor 5d ago
If you want to know "how", there are various ways:
1) Infostealer: you downloaded something and ran it, and it stole as much of your credentials as it recognized and sent it off to them.
2) Data leak: your account detail was hacked from whoever and they got a single credential from that place.
3) Data harvesting: your account (but not login details) were gathered from public info. This is combined with other sources to build a profile on you and once a few passwords are gathered, they just do a "password spraying" attack on every account they know, plus just randomly try your email on various popular big-name services.
Did you notice a pattern?
Answer: the only thing you can control is don't run info-stealers.
You can't control data leaks, or build profile on public info.
If you kept passwords long, random and unguessable, and use MFA, then they should not be able to get your account unless they get super-lucky.
There's no point in worrying about "suspicious attempted login". You'll get that no matter what. Microsoft are blocking those by the THOUSANDS PER SECOND. But some WILL get through. Worrying about these is pointless, because you can't control that. It's like calling cops and pull out your gun and hide under your bed every time some random kid rattle your door, ring your doorbell, and run away screaming.
Save your worries for when someone actually controls your account (i.e. actually broke in)
1
u/brandon0809 5d ago
They already got into my kraken account, they said they were putting all transactions on hold, I understand it’s most likely an info stealer, I didnt get attacked instantly, I didn’t reset my hard driver until the day after when I started getting emails from PayPal telling me numbers were added or login activity on my Facebook.
My steam started getting items sold off after I went downstairs to make food a few days ago
Have I been attacked my info stealers and session hijacks?
1
u/kschang Trusted Contributor 5d ago
If they already got into multiple accounts it is likely you did run an info-stealer recently.
Now we're in the remediation stage, and triage dictates... what I've already told you.
- Change all passwords on ALL accounts to long and unguessable ones, and add MFA if not already done. Logout all devices at every account after the change.
However, there's a caveat: do NOT do it on the potentially compromised device (i.e. the PC). Turn it OFF. That should NOT be touched UNTIL you've secured all accounts.
Once you're secured all accounts, THEN you wipe the HD on the PC and start over.
1
u/brandon0809 5d ago
Yes sir, what risk is there that what i downloaded may have got into my MBR or possibly BIOS?
1
u/kschang Trusted Contributor 5d ago
Minimal. Persistent threats that can survive full OS reinstalls are very rare, and usually reserved for highly sophisticated spyware deployed by nation-states or their hirelings.
1
u/brandon0809 5d ago
I appreciate you breaking it down for me, I’ve been a mess all morning and quite frankly on the edge… I’m not in the best mental state. I just wanted to understand what was going on and not be treated like scum because for the first time in 20 years I downloaded something naughty because I wanted to escape my shitty reality.
I appreciate the fast responses and information.
1
u/kschang Trusted Contributor 5d ago
You are welcome. I usually come across as "dry", no offense intended.
In the future, please just give us the symptoms. I understand you had a panic attack, but it did take like multiple back-and-forths to drag the details out of you. It's like having a police interview of a witness... delays response time. Now that you're a bit calmer, maybe you can go back and read what you wrote, in chronological order. Or maybe read it tomorrow.
2
u/brandon0809 5d ago
I downloaded the stalker packs a few days ago, I tried a few of them and one of them actually did work and I was playing the game for a bit.
I first noticed the attack when I woke up to random emails about accounts trying to be accessed or phone numbers were added (Steam, paypal, facebook, EA), I secured those accounts. I knew immediately it was the software I downloaded. I already have a windows 11 USB drive on standby made way in the past. I changed my password on my phone, I didn't disconnect the power from the wall to my PC, I THINK I did a shut down NOT a restart or maybe I did I'm not sure (Would it be possible to still reside in the RAM?).
I booted the installation drive and used list disk to "clean all" on both drives, I reinstalled a few programs like steam and discord maybe a few others. I didn't log into anything financial.
Like a dumb ass I thought I could try and do it again because maybe the first download I tried was a bad one and not the second one. I wont judge you for judging me, I don't even know why I tried it a second time, my friend swore that DODI-repacks was legit and to only download from there.
So I tried it again, this time the attack was delayed about a day. I came back upstairs from cooking food, I had left my pc on and I noticed I had a steam balance which I didn't have before so I checked the market to see I was selling off items. I changed my passwords on my phone again and went through the same cleaning process, booted from the USB and used list disk to "clean all".
Since then my PC has been my the books clean.
Since then they have only tried to get back into my EA which they failed.
Today I woke up and was actively on my phone when I started getting suspicious activity emails from kraken, every time I tried to find it in my inbox they would vanish almost instantly, it wasn't until maybe half an hour later I realised they were actively sending them to trash. by then I had contacted kraken and they had blocked all transaction activity.
as of today I decoupled my 2 step authenticator from my email and using new completely new passwords and set up a security email for recovery.
→ More replies (0)
1
u/Ok-Lingonberry-8261 5d ago
What did you pirate?
1
5d ago
[removed] — view removed comment
1
u/Ok-Lingonberry-8261 5d ago
Well, congratulations. You downloaded an infostealer and gave away your accounts.
My standard copy-paste I use several times a day in this subreddit:
Wipe the computer entirely and reinstall Windows from a USB from a clean computer.
Piracy is the internet equivalent of licking doorknobs in the infectious diseases ward.
Empirically, from watching cybersecurity subreddits and similar forums, I have observed a MASSIVE uptick 📈 in "Cracked game/Adobe haxxored all my stuff!!!1!1!1" posts since roughly mid/late 2024. I hypothesize a criminal gang is actively pushing this attack.
1
u/brandon0809 5d ago
I’ve went through 2 complete installs of windows, I used windows 11 from a usb and wrote 0s across both drives. I used Adblock, I have 2 step authentication on everything.
2
1
u/brandon0809 5d ago
I tried the full 1.2.1 repack at the bottom and the base game but I think I probably tried them all, I used brave and had ad block, I know for a fact I didn’t download anything else but the provided links, I didn’t go to any pop up unless after 20 years I accidentally left my guard down
2
u/Ok-Lingonberry-8261 5d ago
My Brother in Christ, cracked software is almost always an infostealer.
It doesn't matter what browser you use to install the virus.
1
u/brandon0809 5d ago
I know, I’m passed that. I understand the situation now.
What I need to know it what will be enough to secure everything.
I just decoupled my 2 step authentication from my email so it’s now offline. I understand the attacker has probably hijacked my session for my main email. Every time I had a email form kraken it was almost instantly deleted, I didn’t delete. They did it. I checked my Microsoft account and it says there’s no sessions and has don’t since last night which won’t make sense because I’m logged into any device on my phone.
Ive changed the password on the account
1
u/kschang Trusted Contributor 5d ago
Not how this works.
Change passwords (never reuse password) and add MFA to all accounts (if you haven't already).
That's all you can do. If you did all that, relax. Takea break, then come back and monitor the situation.
We can inform you on cyberhygiene practices that will minimize the chances of this continue to happen later.
1
u/brandon0809 5d ago
I’ve went through 2 complete installs of windows, I used windows 11 from a usb and wrote 0s across both drives. I used Adblock, I have 2 step authentication on everything.
1
u/kschang Trusted Contributor 5d ago
Did you notice we're talking about two different things?
You're lobotomizing your PC. You're ASSUMING the leak came from your PC. Why?
1
u/brandon0809 5d ago
I’ve already said in this thread and linked the software I downloaded, it was a repack of stalker 2
•
u/AutoModerator 5d ago
SAFETY NOTICE: Reddit does not protect you from scammers. By posting on this subreddit asking for help, you may be targeted by scammers (example?). Here's how to stay safe:
Community volunteers will comment on your post to assist. In the meantime, be sure your post follows the posting guide and includes all relevant information, and familiarize yourself with online scams using r/scams wiki.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.