i opened up blender and google chrome and then it just started glitching and flickering suddenly. shortly after bitdefender caught something suspicious. would anybody know what this file actually is? i'm too scared to dig into it i don't want to accidentally spread anything if it is dangerous. i did a full system scan and it says that everything is fine but im scared something is hiding 😭😭😭

it just suddenly appeared at my folders

So I recently did a bad thing.

First time throughout my whole life, without the help of my IT friend. They got onto my Google account and they had to copy my passwords. First 24 hours went smooth... no alerts. No steam taking my cash nothing... then exactly 25 hours after the "incursion "

I noticed my Facebook account was sending the MrBeast thing....but it wasn't sent on:

discord (on which I changed password within 5 minutes)

Steam (password changed even faster)

No mails... nothing. Just a gosh darn Facebook

Even my account wasn't changed to "child's account " maybe bc It was probably harder to do with the limited time they had, as I am the one pay-piggy for the YouTube premium.

Then again... i may be shocked.

I wanted to share this, as I feel a bit safer now that my whole pc was nuked and i had to reinstall everything with much more protection.

HOWEVER.

I am adding this here, that maybe MAYBE there is still a chance the hacker will try to send more stuff, somewhere, despite me doing everything in my power.

So I've been pirating for years and never had any issues, but I recently downloaded a cracked app through bluestacks on my laptop and have been dealing with the consequences since.

Oct 23: Messenger got hacked, I made groupchats with like every contact I had and sent weird Mr Beast Crypto scam messages to everyone. Luckily I was on my phone, and quickly got a hold of my account, changed password, enabled 2FA, deleted every message and apologized to everyone.

Oct 24: I get a notification from my bank that I spent $7.9 on roblox. I check my account and I clearly did not lol, so I immediately file a report to roblox, freeze my credit and debit card and call my bank asking for a new card, which is coming soon.

(I end up checking this out again because I thought they managed to use my credit card for a different account, but it actually was on mine, they just spent it all on gamepasses in russian idk)

Later on oct 24: I get tons of notifications on gmail for telegram codes. I open telegram on my laptop (don't have it on phone) and 1) there's a message to a guy with crypto scams on his profile, 2) Messages to a "spam info bot" checking if my account's limited and 3) Two different sessions on the account, one from LA and one from Nigeria. I terminate both, however they've already changed the password and activated 2FA. They also changed the email, but I changed it back to my own. I hit the "forgot password?" thing, and have to wait 7 days. I also added 2 passkeys and a local passcode.

Oct 25: Guy from nigeria keeps trying to get in the telegram account, from different devices. I terminate the sessions, but I guess he's successful because the email was changed, and the passkey was removed? Idk, there's just a ton of in-app messages from Telegram regarding a login code. To be clear, I have absolutely zero contacts on Telegram, the phone number's old, and the email I added is a spam one.

So far I count my blessings that they haven't (I don't think) accessed any of my main accounts, I still have access to everything google, everything microsoft, got my META accounts, discord, reddit, spotify, etc. I ran a bunch of malware scans with malwarebyte, hitmanpro, windows defender, everything came up clean. I also deleted all cookies for all sites. I won't lie I rely on password autofill a LOT, so I've still been using that. But I did disconnect from my wifi on my laptop and change passwords, maybe not for everything but I tried.

Just wondering what more I can do. I wanna be sure I'm safe and won't have to worry about this. Thank you.

ardent-deer
strict-summit
(keywords from malware log analysis)

I honestly have no idea how Mr beast virus works. I'm assuming it's the other guy (breakbot) that got the virus and not me?

A while back I got hit by an info stealer, and I didn't know this sub existed at the time nor did I have the money to go to a dedicated shop in the big city (I live in the sticks), so I dealt with it on my own. But the steps I took are not the ones I see recommended around here, and tbh my personality is a bit paranoid to begin with, so given this was my first ever time being infected/hacked, I am still more than a bit shaken. Here are the details of what happened.

1) On september 5, I downloaded and ran the Ren'py info stealer. IN MY DEFENSE, the program I was actually trying to download was indeed a Ren'py visual novel, so that's why I didn't realize I had clicked the wrong download link until it was too late, I usually am a lot more careful about this stuff.

2) By the morning of september 6 I discovered my accounts were being stolen, although strangely (or maybe not so strangely, I do have a potential explanation) not all of them. My google mail, which at the time was the centerpiece of all my accounts, was gone, and so were my Nintendo account, my Reddit account and my EA account. There had been an attempt at accessing/password resetting my Steam account, but it had failed (presumably due to 2FA), and my Discord and Riot account had been left alone (presumably because I hadn't created them with my computer, but rather with my phone, and I was doing the thing where I would log in each time by using the phone app to scan the QR code on the PC).

3) I used my phone to change the passwords of all the compromised accounts, then I used the phone to straight-up create a brand new email address with a new provider (something I had been planning to do for a while anyway).

4) I reset my computer to factory settings, explicitly selecting the option to erase all data that had ever been saved on the computer. This is the part that makes me paranoid, because apparently according to many posts I have seen around this sub this might not be enough?

5) From the now blank computer, I reclaimed all the stolen accounts using the new passwords I had set up on phone, then I switched all those accounts to being associated with the new email address I had created on phone. I also made sure to have 2FA enabled on everything this time (and deleted the EA account altogether, honestly I couldn't even remember having that thing to begin with).

By september 7 this whole process was done, and all my accounts were supposedly back under my control. Since then, I have ran full scans with two different antivirus programs every single day, and they were all negative. I ran an offline scan (the one that checks for BIOS stuff), and it was clean. I made it a habit to check the list of connected devices to all my accounts in the morning when I wake up and in the evening before I go to sleep, and I haven't seen a singular trace of suspicious activity (the only devices connected are my computer and my phone). And most importantly, there was no blatantly illegal activity, such as my Reddit suddenly spamming porn bs (which, yes, it did do during the couple days it took me to resecure everything) or my Discord sending scam links to friends (again, my Discord appeared to have been left alone to begin with, although I did change its password and switch it to the new mail just in case).

It is now october 27, so it has been nearly two months since I picked up all these habits, and no suspicious activity of any kind has been spotted. So I *think* it's safe to assume I'm in the clear, but where I live we have a saying that goes "after he gets burnt the cat is afraid even of cold water". There will be a driver issue that will cause my computer to not immediately locate my wifi, and I'll be like "omg am I being hacked again?". There will be a delay in Discord voice chat due to server slowdowns, and I'll be like "omg am I being hacked again?". I am literally jumping at shadows, and the horror stories I read around this sub (resetting to factory settings without installing windows from ab external USB will not remove the backdoor! Info stealers can jump through your wifi and infect your other devices as well!) are certainly not helping.

So yeah, I guess this is less about technical help and more about mental help. Still, if you notice anything obviously wrong about the steps I took, please do let me know. And if there is any way to definitely check whether or not my device is actually clean, that would help too.

Yes as the title says i got hacked,
now i know exactly what i did and how it happened

i went on to download a beamng mod manager from github, idk why it seemed ok, and when i tried to start it nothing happened, soon after my phone blew up on my gmail accounts requesting password resets/email resets and all that 26th of october around 20:00pm europe time (wien/berlin/whatever)

i already delete the mod manager before i got the emails bc it didnt work

im just looking for some help as to what todo now

currently i changed all my email passwords (got 4 accounts) and tried to reset any password on any platform i could and activated 2FA

one steam account is still not mine but i already contacted support, same with a microsoft and blizzard account

i unplugged my pc from the ethernet and i have no wifi card
i wanted to reset windos from a recovery point but it failed because of AppxSatging and i couldn get it to work, even tried some cmd prompts to get the ownership of the WindowsApps files changed but it didnt help

as the problem accoured today or on the 26th of October, is a systemrecovery good enough if it would work or should i do a hard reset? i habe 5 hard drives in my pc do i need to wipe them all clean? can i somehow see or test if the hacker/mailware is still there?

im just a little overwhelmed as i normally look out for such things to not happen to me but whatever :/

any help is appreciatet

also they logged into my instagram account and discord account too and spammed some mr beast crypto stuff, i deleted most of it but on discord im not sure on how many servers this got sent

i think i got lucky because i was instantly doing something when all the emails came, just not sure where to look next or what todo now?

also idk about now downloading anything on that pc bc of the malware, so i cant get help with the frst? or can i do that somehow?

also the hacker/hack just sent pics of it via Insta dm‘s and discord so no links as for the other ones that posted this

if there is a way to install the software mentioned here let me know :)

thanks :/

Recently. roughly 2 days ago, i've gotten hit with the MrBeast scam that affected my Discord, and potentially another account of mine on a game. The virus would set all users on my friendlist to "Ignored" and send them all the messages of what you'd expect, the 4 images and the mention of their username. I've changed both passwords, emails, and also disabled and re-enabled 2FA for all of them on my laptop currently. But I'm still unsure if its fully safe or not, so I've decided to use a FRST scanner. I'm still unsure where or when this scam happened and affected my laptop, but I assume it must've been because I downloaded from an unsafe website (I believe in this case, it could be IGG-Games. My mistake for using that website)

I've followed the guide given from https://www.emsisoft.com/en/help/1738/how-do-i-run-a-scan-with-frst/, and it's all default settings when I hit scan. I currently now am holding both the FRST and Addition txt files. Is there anyone here who's able to help me sort this out and create a fixlist for me? Thank you very much in advance, i'll be awaiting for a response so I can get this started right away for me.

When i was playing an game with my friends my friend show me his file were he get from an fake official website of zero scripts an roblox browser extension to help build roblox game he downloaded it and wanted me to try it out but it was fake website instead of browser extension the file name was zero scripts rar and when i extract it made an malware . So do i need to full factory reset its probably an rat or an ransomware

I don't know it against the rule or not but here we go

Basically, I got hit by it too, so I'm just trying to find other people who went through the same thing. I want to ask a few questions. I've already reinstalled Windows, revoked all active sessions, and changed my password (honestly, I've been doing it every few hours out of paranoia).

Here are my questions:

1. How long has it been since you guys got the virus? How did you deal with it, and has it ever happened again since then?

2. After recovering and revoking everything (like Discord, especially after it promoted that MrBeast scam), do you still use that same account or the linked email? If yes, did the virus ever come back, or how long have you been using them without any signs of it returning?

3. For those who know exactly how the infostealer got installed (like through pirated software or cheats)—after it happened to you, did you keep doing it, swear off it for a while and then go back, or completely stop touching that kind of stuff altogether?

4. Has anyone experienced a Microsoft account takeover where they changed the primary email or did something that caused you to lose access entirely? If so, how did you deal with it and get it back?

I just want to connect with people who have experience with this. I might ask a few more follow-up questions if you reply. Thanks in advance!

Today morning I got this mr beast hacked, already changed my password of discord and do a windows reinstall. After that all I do is install some apps that Ive been using, only 1.1.1.1 and cloudfare. Now I just reveived mail that my discord is disabled again.

Does my pc still have that virus or the hackers still have my discord log in session?

And is there any way to recover my discord account? I cannot get it back this time

Thanks!

Sorry if I am posting this in the wrong subreddit but given that there has been a influx and sudden rise of the infamous MrBeast scam that's been going around and also noticing many users in this sub have been posting that they've gotten their Discords and social media accounts hacked as well as their gaming accounts compromised something that has been burning in my mind recently is Yubikeys.

Ever since a buddy of mine has gotten himself hacked and also became victim to this infamous scam/hack he has went ahead and bought himself a Yubikey. For those who don't know what Yubikeys are, they are physical authentication keys that you can insert into your PC or phone and it allows you to authenticate yourself physically without the need of a password and is considered to be one of the highest security measures one can take when securing their accounts and even more secure than your traditional 2FA security measure.

This is essentially a physical key for all your accounts and although I may not be an expert on it, I am told that it is the best security measure that you can take to secure your accounts. We all know what everyone says when it comes to falling victim to these types of scams and InfoStealers. "Change your PW, wipe your PC, reinstall windows, enable 2FA, yada yada yada." Sure, I myself have enabled 2FA for all of my accounts and all of them are locked behind an authenticator but at the same time, even if I take every security measure and precaution, why does it feel like that it still isn't enough to combat an InfoStealer?

And would Yubikeys themselves provide any difference at all? I myself am close to purchasing a Yubikey myself but the only thing that is stopping me is, if my accounts can still get compromised despite the use of a Yubikey, then what's the reason to buy a Yubikey in the first place if they can just bypass it anyway and continue to inflict harm on your personal accounts.

So the question I have to ask everyone here is, does a Yubikey provide any difference when it comes to combating and dealing with these InfoStealers and say if your Yubikey'ed account does get compromised by a malicious actor. Could they possibly disable/disconnect and unlink your Yubikey from your Discord account for example and render it as a complete and total paperweight?

If anyone knows about how Yubikeys work and have any past experience with them please feel free to share because at this point, I am wondering. Should I grab a Yubikey regardless and set all of my accounts up to where you would need a physical key to log in or should I just stick with what I currently have. Classic 2FA with MS authentication as well as a secure and long PW that consists of numbers, special characters and basic syntax.

Please let me know what is best for me in regards to this situation and if Yubikeys are an effective way to combat something like this. Thanks.

I reinstalled windows and I guess I didn't format my drive right?? Malwarebytes found a trojan on my c: drive folder name windows(dot)old. Does that mean my pc is infected again ?

So I got hit with the Mr Beast infostealer, but ngl, in some years of pirating plugins/softwares I never got hacked, so, the it's my first time lol.

Just so I know, what's the maximum it can do? Cuz I changed passwords on Discord, and Emails are safe.

A few days ago I mentioned that I put a trojan by accident on my brother's computer because I was an idiot. I backed up his files (Most are just images, videos, and video game projects) and I'm about to reinstall the operative system from scratch.

But I have a question, it might be really stupid, but I don't know anything about this and it's the first time this has happened to me. I'm going to scan each of the files with VirusTotal to make sure they're clean, but I know antivirus programs can fail. The thing is, I don't know how likely that is, or if I'm just being paranoid. I don't want to reintroduce a virus into the clean computer. Honestly, I have no idea what this virus does. I couldn't find anything about it online, and I don't know what to expect. I can give more details if that helps; I have some file names and the hash.

That's all I know about it and I don't know how to remove It.

I saw some videos on YouTube but nothing worked.

Someone dealt with this before ? Cause I didn't find any posts about it

So a couple weeks ago I ran a full scan with Malwarebytes to check for anything unwanted. It came up with 2 wmplayer(dot)exe files being trojan viruses. After some online research I came to the conclusion that it was a false positive. I quarantined/deleted the files anyways as they'll be regenerated as needed if it's indeed anything from Steam.

Today I ran another test and the exact same files that got regenerated got labelled as trojans yet again. I just want to play it safe; are these files indeed out of place? Has anyone ever gotten that result before?

If it helps, I'm dual booting Linux Mint and Windows 11.

Thanks in advance!

Several of my accounts were compromised shortly after I installed WO Mic on my Windows laptop. I'm sharing my experience because I've found other people reporting very similar incidents, including the exact same MrBeast scam.

Here's what happened

I downloaded and installed WO Mic on my laptop. I also installed the Android app through the Google Play Store. During the Windows installation, I encountered several security warnings, including SmartScreen, administrator permission requests, and a Microsoft Defender warning. I allowed the installation because I assumed the software was safe and i also used it before. The weird thing is that WO Mic actually worked perfectly fine. I was able to use my phone as a microphone without any problems.

Around the same time, I changed my DNS settings to access Discord and logged into Discord through my browser because discord is banned in my country(idk if it matters). Not long afterward, my accounts started getting hacked. My Discord and Instagram accounts were hijacked, and my main Google account was affected too. That was especially terrifying because almost every account I own is connected to that email address. And somehow they manage to bypass 2FA.

My gaming accounts were also compromised, including Epic Games, EA, Ubisoft, and other gaming platforms. They changed passwords, mail adresses and nicknames on these accounts also. It wasn't just one or two accounts. The attackers used my Discord and Instagram accounts to spread fake MrBeast scam content.

Why I suspect an infostealer

Several unrelated accounts were compromised within a short period, which made me suspect that my browser cookies, saved passwords, or session tokens might have been stolen. I can't confirm this without proper malware analysis, but the pattern seems consistent with an infostealer.

I also had browser synchronization enabled across different devices, which made me concerned about whether my other computers were safe.

What I did to recover

• Recovered access to my compromised accounts.
• Changed my passwords from a trusted device.
• Enabled or reconfigured two-factor authentication.
• Signed out of existing sessions wherever possible.
• Cleared browser data and removed saved passwords.
• Performed a clean Windows installation on my laptop.
• Installed antivirus(kaspersky) and checked my account security settings.

Thankfully, I managed to recover my main accounts.

One concern remains

I also have a desktop PC that had been powered off for over a month when the attacks happened. Some of my accounts had previously been logged in there, and browser synchronization was enabled.

I haven't turned on that desktop since the incident, and I have no evidence that it was infected. However, I'm worried about whether malware or compromised browser data could still be present on it. I'm considering backing up my important files and performing a clean Windows installation, but I don't know whether that's actually necessary.

Why I'm posting this

I recently found another Reddit post from someone who installed WO Mic, encountered security warnings, and later had their accounts compromised with the same MrBeast scam. I also found other discussions about suspicious antivirus detections involving WO Mic installers.

I know correlation doesn't equal causation. I can't prove WO Mic was responsible.

My questions

1. Has anyone experienced something similar after installing WO Mic? Especially account hijacking involving fake MrBeast scam posts?
2. Does this sound like an infostealer or session-cookie hijacking? Could that explain how multiple unrelated accounts were compromised around the same time?
3. Could my other desktop PC also be infected? It was powered off for more than a month before the attack, but I previously used some of the same accounts and had browser synchronization enabled. or maybe the computer that infected was my desktop not laptop?! but as i said that desktop was turned off for 1 month when this happened.
4. Can malware spread between computers through browser synchronization? For example, could Chrome or Brave Sync transfer something malicious from an infected laptop to another computer?
5. Should I completely reinstall Windows on my desktop as a precaution? Or would a full Microsoft Defender/Malwarebytes scan be sufficient, considering the desktop wasn't even running when the attack happened?
6. Is it possible that credentials or session cookies were stolen from my desktop before it was shut down? Could attackers have used that information weeks later, even while the computer was offline?
7. Could my accounts still be at risk after everything I've done? I've reinstalled Windows on my laptop, changed passwords, enabled 2FA, and revoked sessions wherever possible. Is there anything important I might have missed?
8. How can I safely back up files from a potentially infected computer? I have important design projects on my desktop that I absolutely cannot afford to lose. Would copying PSD, AI, video, and other project files to an external drive be safe before reinstalling Windows?
9. Has anyone actually analyzed WO Mic installers for infostealers or other malware? I'd be interested in any technical findings, particularly if different download sources distribute different installers.

I just want to understand what happened, make sure my devices and accounts are safe, and hopefully help anyone else experiencing something similar. Any advice from people experienced with malware analysis or incident response would be greatly appreciated.