I fell for a fake browser verification prompt that told me to press Win+R, paste a command, and press Enter. I ran a PowerShell command that downloaded and executed code from a remote website. Windows Security then reported and quarantined Trojan:Script/Wacatac.H!ml, Behavior:Win32/SuspLumma.H, and Behavior:Win32/SuspClickFix.F. A full Windows Security scan and Malwarebytes scan are now clean. Does that mean my information was safe, or should I assume passwords, browser sessions, and other data may have been exposed? I have already disconnected the computer, started changing passwords, and plan to perform a clean Windows installation using installation media from another computer.
4 Answers
If you were using an administrator account, assume the risk is higher and proceed with the clean reinstall rather than trying to investigate indefinitely. Also review account activity and financial statements for anything unusual. The fact that Windows blocked or quarantined part of the attack is encouraging, but it does not guarantee that every component was stopped before execution.
The detections being quarantined quickly is a better outcome than having no detection at all, but it is not enough to establish that the system or accounts are safe. Lumma is an information-stealing malware family that may target saved passwords, browser cookies, active login sessions, cryptocurrency wallets, and other stored data. Changing passwords and invalidating sessions is the sensible precaution.
A clean scan does not prove that nothing was taken. The command downloaded and ran PowerShell code, and the Lumma-related detection is associated with information stealers. Treat every account used on that computer as potentially compromised. From a known-clean device, change your email, password-manager, financial, and other important passwords, sign out of existing sessions, check recovery settings and email-forwarding rules, and enable multifactor authentication. Do not log back into those accounts from the affected installation.
The safest approach is to wipe the computer and reinstall Windows. Boot from the installation USB, choose a custom installation, delete the existing Windows partitions, and install to the resulting unallocated space. This is more thorough than a reset that preserves files. Restore only personal documents you trust—do not copy old programs, scripts, browser profiles, or unknown executables. A clean scan only indicates that security software does not currently see active malware; it cannot confirm that data was not copied earlier.
I created a Windows installer USB on another computer. Do I just plug it in and boot from it, and how is that different from using Reset this PC?
What exactly are PowerShell and Lumma, and is there still a risk if the computer stays disconnected from the internet?