Cybercriminals go after people’s personal information across every kind of online platform, including WhatsApp, Instagram, LinkedIn, Roblox, YouTube and Spotify, not to mention finance apps. No online account is off the table. If one of your own accounts falls victim, the first priority is to avoid losing your cool and act immediately – the faster you move, the more of the attacker's work you can interrupt.
The attacker's first move after gaining access could be to make that access (near)-permanent, including by changing the recovery email address, adding their own backup codes or setting up silent email forwarding rules so they can monitor your account even after you've changed your password.
Here are a few practical steps to take while there’s often still a chance to undo the damage. Importantly, don't worry if you find it impossible to get through all the steps in the 15-minute sequence outlined below – this framing is more of a prompt to move fast, not a hard deadline!
Check whether you still have access to the account and, if you can, consider how the breach probably happened.
If you suspect you may have fallen victim to a phishing incident but still have access to your account, go on to secure it in line with the guidance below. Ideally, use a device other than the one where you first noticed something was wrong.
If you can no longer access the account at all, go to the platform’s support pages and start the account recovery process. Don't waste time trying to log in time and again. If financial accounts are involved, call your bank or credit card provider and ask them specifically to block transactions and flag the account for monitoring.
If you suspect malware is involved – say, you’ve installed software from sketchy corners of the internet or downloaded a suspicious email attachment – disconnect the device from the internet. An active malware compromise could be exfiltrating data or communicating with an attacker in real time, so you want to stop that.
In any case, if you have up-to-date security software on the device, initiate a full scan. Don't wait for it to complete, however – start it running and move to the next steps, from a different device. If you don’t have any security software and remain online, ESET’s online scanner can help. Meanwhile, ESET’s link checker can flag any specific malicious URLs in an instant.
Importantly, don't delete anything yet. Online services may ask for suspicious messages and other potential evidence during the reporting and account recovery process.
If the incident hit your email account, pay attention to email forwarding rules, which attackers often configure silently so that copies of incoming emails reach them even after you've regained control. Most email clients list active forwarding rules in settings – check them and remove anything you didn't set up yourself.
Check also the account's recovery settings – the backup email address, recovery phone number and backup codes. Change the password, from a device you're confident is clean. The password needs to be strong and unique – not a variation of something you've used before or somewhere else.
If you can, go on to enable two-factor authentication (2FA) even if the service doesn’t prompt you to do so. In the emergency stage, SMS codes should do the job but over the long term an authenticator app, such as Google Authenticator or Microsoft Authenticator, is a safer choice. Hardware security keys are stronger still, though they work best for long-term protection.
One-time 2FA recovery codes can help save the day if you lose access to the device to which normal 2FA codes are typically sent. Store the recovery codes somewhere safe, possibly offline and as a printed copy. Losing those codes can lock you out of your account permanently.
Finally, close all active sessions and revoke access to connected third-party services.
If you've reused the same password on other platforms, change it everywhere. Credential stuffing – which is where attackers automatically test a stolen username and password combination across a number of platforms – is largely automated and takes seconds. If the credentials worked once, they'll be tried again.
Whenever possible, check the login history and recent activity to detect unrecognized logins. Also, check for anything that seems off: contact details you didn't modify, sent messages you don't recognize, and unfamiliar purchases or transactions. An email account deserves particular attention. Control over your inbox may often equate to control over much of your entire digital identity.
Review the list of the software installed and remove anything you didn't install or don’t recognize. Take a look also at web browser extensions, as those often fly under the radar. Check that your operating system and other software run their latest version, as malware often exploits vulnerabilities for which patches are available.
Alert your family and friends about what happened (through other channels if you haven’t restored access to your account). An attacker who has stolen your login credentials can impersonate you and spread the 'infection' further, including by sending malicious links to your friends and tricking them into wiring money. The sooner they know, the less exposure there is.
Also, report the incident to the platform if you haven’t already. If financial accounts may be affected and you haven't called your bank yet, do so now (i.e., don’t just file an online report). Ask specifically about blocking transactions and setting up activity monitoring.
Once your security software completes the scan, review what it has found and act in line with its guidance.
A few habits can make a major difference:
Panic is the first hurdle to clear when an account gets hacked. A clear contingency plan helps you move past it quickly. It also reinforces something worth keeping in mind outside of emergencies: the habits that make recovery faster are mostly the same habits that make the initial attack harder. In addition to helping after something goes wrong, they also raise the cost of the attack enough that many attackers move on to easier targets.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。