Malware stole your passwords and logins. Here's how to get everything back.

Do these five things first, in this order

The order is not optional. Changing passwords while the infected machine is still running online just hands the attacker the new ones.

1. 01

   Get the infected computer off the internet

   Unplug the network cable or turn off Wi-Fi. Don't shut it down if you might want evidence later — just disconnect it.

2. 02

   Switch to a clean device

   Another computer, or your phone on mobile data. Everything from here happens there, not on the infected machine.

3. 03

   Change the password on your main email account first

   Email is the master key — whoever controls it can reset everything else. Do this one before any other account.

4. 04

   Sign out of all devices, everywhere

   This is the step people skip and it's the one that actually evicts the attacker. Look for “sign out everywhere”, “log out of all sessions” or “manage devices” in each account's security settings.

5. 05

   Check what they added to your accounts

   New recovery emails or phone numbers, new two-factor apps, new email forwarding rules, new authorised apps. Attackers add these so they can walk back in after you change the password. Remove anything you don't recognise.

What did the malware actually take?

Modern info-stealers are not subtle. They run once, copy everything of value in a few seconds, send it to the attacker and often delete themselves. Assume all of the following left your machine.

This is why an antivirus scan is not enough. The theft already happened. Cleaning the machine stops it happening again; it does not undo anything.

They changed my password and recovery options — am I locked out for good?

Usually not, but the normal “forgot password” link won't work any more. You need the provider's account recovery process, which verifies you as a human using what you remember about the account.

If an account is tied to a phone number you still control, or to a bank card you still hold, say so in the recovery form. Those are among the strongest proofs of ownership available to you.

They're posting from my Instagram but my password still works

That's stolen-session theft rather than password theft. The attacker is riding a copy of your logged-in state, so your password never stopped working and no login alert ever fired.

The fix is the same on every platform: change the password, then explicitly end all active sessions — Instagram calls it “Log out of all sessions”, Google calls it “Sign out of all devices”, Discord has “Log out of all known devices”. Until you do that, the copied session keeps working no matter how many times you change the password. Then turn two-factor on, or off and on again, which invalidates old tokens on most platforms.

What about stolen cryptocurrency?

What is still worth doing:

• Move anything remaining to a brand new wallet, created on a clean device. Never reuse the old seed phrase — the attacker has it.
• Revoke token approvals from the old wallet, using the revoke feature in your wallet software itself rather than a site you found in search results.
• If funds sat on an exchange rather than your own wallet, contact that exchange immediately. They can sometimes freeze accounts and stolen funds are occasionally recovered when they pass through one.
• File a police report, and in the US also an IC3 report. It rarely gets funds back but it creates the record you'll need for insurance, taxes or any future case.
• Never enter your seed phrase into anything, ever, including a "recovery tool". That is the single most common follow-up scam.

Watch out for the second wave of scams

Searching for help after being hacked is itself dangerous. Those searches are saturated with paid "account recovery services", "ethical hacker for hire" sites and fake support accounts that reply within minutes on social media. They exist because people in your position will pay anything.

• No legitimate recovery ever costs money. All of it is free and on the provider's own site.
• Real support will never DM you first, and never asks for your password, seed phrase or a 2FA code.
• Anyone guaranteeing results is lying — no one can guarantee a provider's decision.
• If someone contacts you about your hack unprompted, they are involved or they are a scammer.

How do I clean the computer?

Reinstall Windows from scratch. It sounds drastic, but these infections routinely arrive bundled with other tools designed to survive removal, and you cannot verify a clean-up worked. A reinstall you can trust.

• Back up your personal files first, but not programs or installers.
• Reinstall from Microsoft's official media, not a recovery partition that may itself be tampered with.
• Only sign back into accounts after you've reset their passwords and ended their sessions.
• Don't restore a system image from after the infection — it brings the malware back.

How do I stop this happening again?

• Stop saving passwords in the browser. Use a dedicated password manager with its own master password — stealers grab browser stores by default.
• Switch to passkeys where offered. They can't be copied off your machine the way a password or session file can.
• Cracked games, "free" paid software, cheat tools and mods from strangers are the single most common delivery route. That's what happened here.
• Keep crypto of any real value on a hardware wallet. It cannot be stolen by software alone.

Common questions