What to do if you've been compromised

We will get right into the important details, and we can explain more on what's happened later - if you see a new high-risk credential, we recommend doing the following:

• Change your passwords from a trusted device. Prioritise higher-value accounts - email first. You can use a password manager to help with this - it will generate different strong passwords for each website you use, which decreases the impact of one password being compromised. It also has autofill compatibility.
• Turn on two-factor authentication (2FA) everywhere possible. If available, select the passkey option.
• Sign out everywhere. In almost all of our high-risk logs, we identify active valid sessions for different websites which were stolen from compromised devices. Find and use the "log out of all sessions" or "sign out other devices" option if available.
• Clean your system. We recommend Bitdefender and/or Windows Defender - but it may be a safe bet to backup your important files (no executables) and reinstall your operating system if you know which machine was compromised. We have more info later in this article on what could have triggered the compromise, which may help you narrow it down to a certain machine. Also, update your operating system and applications.
• Keep an eye on account activity - watch your bank statements, and be careful of emails, texts or calls that reference your details - leaked data is sometimes used to make phishing more convincing. If you do see any suspicious transactions, it may be a good idea to deactivate the affected card or account

If it's a work device, or your work accounts are affected:

• Tell your IT or security team promptly. One infected laptop can expose access to your employer's systems, which could lead to business compromise. Your IT team would definitely prefer you let them know rather than keep it a secret.

Finding your email address in infostealer data can be scary or alarming, but it is a solvable problem, and acting quickly closes the window an attacker has.

What happened?

An infostealer is malware that runs on a device and quietly copies saved passwords, browser cookies, and other credentials, then uploads them to whoever operates it.

When we mark credentials as high-risk, it means that we believe the credentials are highly likely to be fresh, rather than resurfaced old credentials. Standard credentials which haven't been marked as high-risk could be new, but we were unable to tell for sure. They should still be investigated.

If you're unsure on how you were infected, the most common infostealer infection methods are:

• Infected software - Pirated software, or seemingly-legitimate (but infected) installers are very common. Make sure you're downloading software legitimately from a trusted source - we have seen an uptick recently in infections arising from "Sponsored" URLs on Google - be careful, and verify that the domain is legitimate, and that the page isn't controllable by any user (e.g. Claude Code artifact pages).
• ClickFixing - We are seeing a huge rise in ClickFix attacks. ClickFixing is a social engineering technique, in which a popup will appear prompting the user to run a system command which, unbeknownst to the user, installs an infostealer or other malware. This popup usually disguises itself as a verification step, asking you to press Win+R to open a run dialogue, and paste something before hitting enter.
• Phishing - While less common, we do see some infections arise from malicious links in emails or email attachments. Have a think before clicking and installing.

Subscribe for notifications!

You can sign up for email notifications completely free of charge. There's no catch, and your employer can also sign-up (again, for free) to continuously monitor your entire company.