I honestly have no idea how Mr beast virus works. I'm assuming it's the other guy (breakbot) that got the virus and not me?

A woman I met in a crypto sphere started talking to me thinking I was some older rich guy but I am in fact a really broke ass bitch. Anywho, two days ago, she got me to play some steam game called Golf Around, reviews were fine at the time but my computer started acting a little strange. Pages refreshing infinitely, tabs closing on their own. I look back at the game reviews and two people are talking about how they got a RAT from it. Super weird. I factory reset the pc but only the OS. I change passwords, reinstall trusted games, but something is off. Antiviruses run clear, but while I was using the computer I touched absolutely nothing and I saw my discord dms get tabbed over in real time. I try to disconnect from the WIFI immediately but my mouse no longer is responding, it moves, but it does not click, and I can’t open the WIFI bar from the bottom. I press windows key and disconnect from the wifi from there.. I could just be paranoid, it’s a slightly older laptop, but something seems veryyy off. I think this thing survived a reset, windows offline security or whatever found nothing, basically.. What do I do?

So I got hit with the Mr Beast infostealer, but ngl, in some years of pirating plugins/softwares I never got hacked, so, the it's my first time lol.

Just so I know, what's the maximum it can do? Cuz I changed passwords on Discord, and Emails are safe.

So I've been pirating for years and never had any issues, but I recently downloaded a cracked app through bluestacks on my laptop and have been dealing with the consequences since.

Oct 23: Messenger got hacked, I made groupchats with like every contact I had and sent weird Mr Beast Crypto scam messages to everyone. Luckily I was on my phone, and quickly got a hold of my account, changed password, enabled 2FA, deleted every message and apologized to everyone.

Oct 24: I get a notification from my bank that I spent $7.9 on roblox. I check my account and I clearly did not lol, so I immediately file a report to roblox, freeze my credit and debit card and call my bank asking for a new card, which is coming soon.

(I end up checking this out again because I thought they managed to use my credit card for a different account, but it actually was on mine, they just spent it all on gamepasses in russian idk)

Later on oct 24: I get tons of notifications on gmail for telegram codes. I open telegram on my laptop (don't have it on phone) and 1) there's a message to a guy with crypto scams on his profile, 2) Messages to a "spam info bot" checking if my account's limited and 3) Two different sessions on the account, one from LA and one from Nigeria. I terminate both, however they've already changed the password and activated 2FA. They also changed the email, but I changed it back to my own. I hit the "forgot password?" thing, and have to wait 7 days. I also added 2 passkeys and a local passcode.

Oct 25: Guy from nigeria keeps trying to get in the telegram account, from different devices. I terminate the sessions, but I guess he's successful because the email was changed, and the passkey was removed? Idk, there's just a ton of in-app messages from Telegram regarding a login code. To be clear, I have absolutely zero contacts on Telegram, the phone number's old, and the email I added is a spam one.

So far I count my blessings that they haven't (I don't think) accessed any of my main accounts, I still have access to everything google, everything microsoft, got my META accounts, discord, reddit, spotify, etc. I ran a bunch of malware scans with malwarebyte, hitmanpro, windows defender, everything came up clean. I also deleted all cookies for all sites. I won't lie I rely on password autofill a LOT, so I've still been using that. But I did disconnect from my wifi on my laptop and change passwords, maybe not for everything but I tried.

Just wondering what more I can do. I wanna be sure I'm safe and won't have to worry about this. Thank you.

ardent-deer
strict-summit
(keywords from malware log analysis)

i opened up blender and google chrome and then it just started glitching and flickering suddenly. shortly after bitdefender caught something suspicious. would anybody know what this file actually is? i'm too scared to dig into it i don't want to accidentally spread anything if it is dangerous. i did a full system scan and it says that everything is fine but im scared something is hiding 😭😭😭

Recently. roughly 2 days ago, i've gotten hit with the MrBeast scam that affected my Discord, and potentially another account of mine on a game. The virus would set all users on my friendlist to "Ignored" and send them all the messages of what you'd expect, the 4 images and the mention of their username. I've changed both passwords, emails, and also disabled and re-enabled 2FA for all of them on my laptop currently. But I'm still unsure if its fully safe or not, so I've decided to use a FRST scanner. I'm still unsure where or when this scam happened and affected my laptop, but I assume it must've been because I downloaded from an unsafe website (I believe in this case, it could be IGG-Games. My mistake for using that website)

I've followed the guide given from https://www.emsisoft.com/en/help/1738/how-do-i-run-a-scan-with-frst/, and it's all default settings when I hit scan. I currently now am holding both the FRST and Addition txt files. Is there anyone here who's able to help me sort this out and create a fixlist for me? Thank you very much in advance, i'll be awaiting for a response so I can get this started right away for me.

Yes as the title says i got hacked,
now i know exactly what i did and how it happened

i went on to download a beamng mod manager from github, idk why it seemed ok, and when i tried to start it nothing happened, soon after my phone blew up on my gmail accounts requesting password resets/email resets and all that 26th of october around 20:00pm europe time (wien/berlin/whatever)

i already delete the mod manager before i got the emails bc it didnt work

im just looking for some help as to what todo now

currently i changed all my email passwords (got 4 accounts) and tried to reset any password on any platform i could and activated 2FA

one steam account is still not mine but i already contacted support, same with a microsoft and blizzard account

i unplugged my pc from the ethernet and i have no wifi card
i wanted to reset windos from a recovery point but it failed because of AppxSatging and i couldn get it to work, even tried some cmd prompts to get the ownership of the WindowsApps files changed but it didnt help

as the problem accoured today or on the 26th of October, is a systemrecovery good enough if it would work or should i do a hard reset? i habe 5 hard drives in my pc do i need to wipe them all clean? can i somehow see or test if the hacker/mailware is still there?

im just a little overwhelmed as i normally look out for such things to not happen to me but whatever :/

any help is appreciatet

also they logged into my instagram account and discord account too and spammed some mr beast crypto stuff, i deleted most of it but on discord im not sure on how many servers this got sent

i think i got lucky because i was instantly doing something when all the emails came, just not sure where to look next or what todo now?

also idk about now downloading anything on that pc bc of the malware, so i cant get help with the frst? or can i do that somehow?

also the hacker/hack just sent pics of it via Insta dm‘s and discord so no links as for the other ones that posted this

if there is a way to install the software mentioned here let me know :)

thanks :/

So I recently did a bad thing.

First time throughout my whole life, without the help of my IT friend. They got onto my Google account and they had to copy my passwords. First 24 hours went smooth... no alerts. No steam taking my cash nothing... then exactly 25 hours after the "incursion "

I noticed my Facebook account was sending the MrBeast thing....but it wasn't sent on:

discord (on which I changed password within 5 minutes)

Steam (password changed even faster)

No mails... nothing. Just a gosh darn Facebook

Even my account wasn't changed to "child's account " maybe bc It was probably harder to do with the limited time they had, as I am the one pay-piggy for the YouTube premium.

Then again... i may be shocked.

I wanted to share this, as I feel a bit safer now that my whole pc was nuked and i had to reinstall everything with much more protection.

HOWEVER.

I am adding this here, that maybe MAYBE there is still a chance the hacker will try to send more stuff, somewhere, despite me doing everything in my power.

it just suddenly appeared at my folders

Sorry if I am posting this in the wrong subreddit but given that there has been a influx and sudden rise of the infamous MrBeast scam that's been going around and also noticing many users in this sub have been posting that they've gotten their Discords and social media accounts hacked as well as their gaming accounts compromised something that has been burning in my mind recently is Yubikeys.

Ever since a buddy of mine has gotten himself hacked and also became victim to this infamous scam/hack he has went ahead and bought himself a Yubikey. For those who don't know what Yubikeys are, they are physical authentication keys that you can insert into your PC or phone and it allows you to authenticate yourself physically without the need of a password and is considered to be one of the highest security measures one can take when securing their accounts and even more secure than your traditional 2FA security measure.

This is essentially a physical key for all your accounts and although I may not be an expert on it, I am told that it is the best security measure that you can take to secure your accounts. We all know what everyone says when it comes to falling victim to these types of scams and InfoStealers. "Change your PW, wipe your PC, reinstall windows, enable 2FA, yada yada yada." Sure, I myself have enabled 2FA for all of my accounts and all of them are locked behind an authenticator but at the same time, even if I take every security measure and precaution, why does it feel like that it still isn't enough to combat an InfoStealer?

And would Yubikeys themselves provide any difference at all? I myself am close to purchasing a Yubikey myself but the only thing that is stopping me is, if my accounts can still get compromised despite the use of a Yubikey, then what's the reason to buy a Yubikey in the first place if they can just bypass it anyway and continue to inflict harm on your personal accounts.

So the question I have to ask everyone here is, does a Yubikey provide any difference when it comes to combating and dealing with these InfoStealers and say if your Yubikey'ed account does get compromised by a malicious actor. Could they possibly disable/disconnect and unlink your Yubikey from your Discord account for example and render it as a complete and total paperweight?

If anyone knows about how Yubikeys work and have any past experience with them please feel free to share because at this point, I am wondering. Should I grab a Yubikey regardless and set all of my accounts up to where you would need a physical key to log in or should I just stick with what I currently have. Classic 2FA with MS authentication as well as a secure and long PW that consists of numbers, special characters and basic syntax.

Please let me know what is best for me in regards to this situation and if Yubikeys are an effective way to combat something like this. Thanks.

I don't know it against the rule or not but here we go

Basically, I got hit by it too, so I'm just trying to find other people who went through the same thing. I want to ask a few questions. I've already reinstalled Windows, revoked all active sessions, and changed my password (honestly, I've been doing it every few hours out of paranoia).

Here are my questions:

1. How long has it been since you guys got the virus? How did you deal with it, and has it ever happened again since then?

2. After recovering and revoking everything (like Discord, especially after it promoted that MrBeast scam), do you still use that same account or the linked email? If yes, did the virus ever come back, or how long have you been using them without any signs of it returning?

3. For those who know exactly how the infostealer got installed (like through pirated software or cheats)—after it happened to you, did you keep doing it, swear off it for a while and then go back, or completely stop touching that kind of stuff altogether?

4. Has anyone experienced a Microsoft account takeover where they changed the primary email or did something that caused you to lose access entirely? If so, how did you deal with it and get it back?

I just want to connect with people who have experience with this. I might ask a few more follow-up questions if you reply. Thanks in advance!

I reinstalled windows and I guess I didn't format my drive right?? Malwarebytes found a trojan on my c: drive folder name windows(dot)old. Does that mean my pc is infected again ?

A while back I got hit by an info stealer, and I didn't know this sub existed at the time nor did I have the money to go to a dedicated shop in the big city (I live in the sticks), so I dealt with it on my own. But the steps I took are not the ones I see recommended around here, and tbh my personality is a bit paranoid to begin with, so given this was my first ever time being infected/hacked, I am still more than a bit shaken. Here are the details of what happened.

1) On september 5, I downloaded and ran the Ren'py info stealer. IN MY DEFENSE, the program I was actually trying to download was indeed a Ren'py visual novel, so that's why I didn't realize I had clicked the wrong download link until it was too late, I usually am a lot more careful about this stuff.

2) By the morning of september 6 I discovered my accounts were being stolen, although strangely (or maybe not so strangely, I do have a potential explanation) not all of them. My google mail, which at the time was the centerpiece of all my accounts, was gone, and so were my Nintendo account, my Reddit account and my EA account. There had been an attempt at accessing/password resetting my Steam account, but it had failed (presumably due to 2FA), and my Discord and Riot account had been left alone (presumably because I hadn't created them with my computer, but rather with my phone, and I was doing the thing where I would log in each time by using the phone app to scan the QR code on the PC).

3) I used my phone to change the passwords of all the compromised accounts, then I used the phone to straight-up create a brand new email address with a new provider (something I had been planning to do for a while anyway).

4) I reset my computer to factory settings, explicitly selecting the option to erase all data that had ever been saved on the computer. This is the part that makes me paranoid, because apparently according to many posts I have seen around this sub this might not be enough?

5) From the now blank computer, I reclaimed all the stolen accounts using the new passwords I had set up on phone, then I switched all those accounts to being associated with the new email address I had created on phone. I also made sure to have 2FA enabled on everything this time (and deleted the EA account altogether, honestly I couldn't even remember having that thing to begin with).

By september 7 this whole process was done, and all my accounts were supposedly back under my control. Since then, I have ran full scans with two different antivirus programs every single day, and they were all negative. I ran an offline scan (the one that checks for BIOS stuff), and it was clean. I made it a habit to check the list of connected devices to all my accounts in the morning when I wake up and in the evening before I go to sleep, and I haven't seen a singular trace of suspicious activity (the only devices connected are my computer and my phone). And most importantly, there was no blatantly illegal activity, such as my Reddit suddenly spamming porn bs (which, yes, it did do during the couple days it took me to resecure everything) or my Discord sending scam links to friends (again, my Discord appeared to have been left alone to begin with, although I did change its password and switch it to the new mail just in case).

It is now october 27, so it has been nearly two months since I picked up all these habits, and no suspicious activity of any kind has been spotted. So I *think* it's safe to assume I'm in the clear, but where I live we have a saying that goes "after he gets burnt the cat is afraid even of cold water". There will be a driver issue that will cause my computer to not immediately locate my wifi, and I'll be like "omg am I being hacked again?". There will be a delay in Discord voice chat due to server slowdowns, and I'll be like "omg am I being hacked again?". I am literally jumping at shadows, and the horror stories I read around this sub (resetting to factory settings without installing windows from ab external USB will not remove the backdoor! Info stealers can jump through your wifi and infect your other devices as well!) are certainly not helping.

So yeah, I guess this is less about technical help and more about mental help. Still, if you notice anything obviously wrong about the steps I took, please do let me know. And if there is any way to definitely check whether or not my device is actually clean, that would help too.