Hey everyone, I just had a bit of a panic after getting a Cloudflare verification prompt on a website. It asked me to hit windows+r and run a command they provided for a verification code. I was kind of on autopilot and did it, but afterward, I realized it might have been a mistake. I've done some digging online and found people saying they were hacked after similar situations, but so far, nothing seems to have happened to my stuff. I did uninstall an app called Kroqoul Civil Tools and deleted some roaming files associated with it. I also shut down my PC and restarted it, plus ran a scan with Windows Defender, which didn't find anything. Am I just lucky, or should I be worried?
4 Answers
First thing's first, consider reinstalling Windows from a USB stick to be safe. Also, change your passwords for sensitive accounts and enable two-factor authentication where you can. It's always better to be cautious, especially after running random commands you don’t fully understand.
Definitely run a full antivirus scan with tools like Windows Defender and Malwarebytes. Just a heads up, messing around in CMD with random commands can be risky. That exact command you ran essentially downloaded and executed a file on your system, which could potentially be dangerous.
It sounds pretty risky, especially since you installed something called "o" unintentionally. It’s hard to know exactly what that program does without more analysis.
This seems a lot like Lumma stealer malware. I recommend backing up your data and then reinstalling your OS from a clean USB. Make sure to also reset all your passwords and use multi-factor authentication, but only do this from a trusted device.
Yeah, I wish I could run it through a sandbox right now to check it, but online analysis tools can give some insights too.