I left a headless PC asleep with a browser open to a speed-testing site and hadn't used it for several weeks. When I came back, I found unfamiliar ads, a recently downloaded browser or executable, and a process called "brutessh" repeatedly opening a file named "ssh_targets" and displaying "honeypot connected." Whenever it ran, my network became unusably slow. Killing the process or disconnecting the PC immediately fixed the problem, so the machine is currently shut down and isolated.
I'm certain no person used the computer during that time, but my cat regularly sits on the keyboard. Could it realistically have pressed Enter or other keys, clicked an ad, downloaded a file, and launched malware? Or is there a more likely explanation?
4 Answers
The network behavior sounds like the machine may be participating in scanning or some other unwanted activity. The suspicious tool may have replaced a legitimate updater, and installed peer-to-peer software is another possible source of the infection. The cat may have been involved, but the evidence only proves that something ran while the computer was unattended—not that the cat deliberately installed it.
Run reputable offline malware scans such as Malwarebytes or AdwCleaner if you need to investigate, but don’t rely on a clean scan for a system showing this behavior. Disconnect it first, change important passwords from a different trusted device, and reinstall from clean installation media if there’s no verified backup.
The advertising site itself shouldn’t normally be able to silently install arbitrary software in a fully updated browser, especially with an effective content blocker. An unapproved browser appearing on the system suggests either an existing compromise, a bundled download, or someone—or something—using the machine with more access than expected. Install an ad blocker and remove unnecessary browsers after rebuilding the PC.
A cat could definitely trigger keyboard shortcuts, click things, or activate a macro, but installing and running malware would usually require a whole chain of fortunate key presses and a system that permits downloads or execution without confirmation. Treat the PC as compromised regardless of how it happened. Keep it disconnected, back up only essential personal files, and preferably wipe and reinstall the operating system rather than trusting that a scan removed everything.
A restore from a known-clean system image would also be reasonable if you have one. Don’t reconnect the machine to the network until it has been restored or rebuilt.