My Discord account on my PC was recently compromised and used to promote crypto-related scams. I signed out, changed my passwords, and have avoided logging back into Discord for the past three days. Today, Steam attempted to gift a game to someone, but Steam blocked the transaction. I'm worried that malware on my computer may be stealing session data or account credentials.
I ran both quick and full scans with Windows Security, but they found nothing. I haven't knowingly downloaded anything recently, although I visited a few reservation websites while planning an international trip. I'm not sure whether this is an infection, leaked credentials, stolen browser cookies, or just a string of bad luck. What steps should I take to secure my accounts and determine whether the computer is compromised?
Update: HitmanPro detected and quarantined five items. A second scan and RKill scan reported no further malware. I'm also running Malwarebytes and would appreciate advice on confirming that the system and my accounts are safe.
3 Answers
The activity could come from malware, but it could also be a reused or exposed password, a stolen browser cookie, or an already-authorized session. Discord and Steam being affected close together makes it worth treating the PC as potentially compromised until you finish checking it. Sign out all sessions, change passwords, enable two-factor authentication, and contact platform support about the unauthorized activity. If scans keep finding anything suspicious, back up only personal documents and consider reinstalling Windows from trusted installation media.
A clean Windows scan doesn’t completely rule out an infection because different scanners detect different threats, and some account compromises happen without a currently active virus. Don’t log back into sensitive accounts until the checks are complete. Inspect startup programs and scheduled tasks, remove suspicious browser extensions, update Windows and your browsers, and scan again after restarting. If you still can’t establish what happened, a clean operating-system reinstall is the most reliable way to regain confidence.
Run a second-opinion scan with tools such as HitmanPro and Malwarebytes, then check your browser extensions, downloads folder, saved sessions, and notification permissions for anything unfamiliar. Remove software or browser add-ons you don’t recognize. Since multiple accounts were involved, change their passwords from a known-clean device, make every password unique, revoke active sessions, and review account recovery details and login history. Keep Steam Guard enabled, but remember that an authenticator doesn’t necessarily protect an already-stolen session cookie.
HitmanPro found five items and quarantined them. A follow-up scan reported nothing, and I’m running Malwarebytes now. I’ll also review my browser sessions and account activity.
Steam already had an authenticator enabled, which is why the attempted gift was confusing. I’m going to revoke sessions and check the account histories rather than relying only on the authenticator.