Malicious browser extension compromised my accounts—what should I do now?
Asked by
MellowCedar47
I installed an extension called "RBX Multiple" from a video because I wanted to run multiple game instances. It required enabling developer mode and manually installing the extension in Opera GX, but it never worked. About four hours later, my game accounts were accessed and items were traded away. Soon afterward, my Discord account sent scam messages to recent contacts, and I found password-change attempts or successful changes involving several gaming, email, and other online accounts.
I removed the extension, reset Opera GX, logged out of my accounts, and ran scans with Windows Security and Avast, but they did not find anything significant. What should I do next to prevent further damage, especially to my email and financial accounts? Could the extension only have stolen browser data and session cookies, or might it have gained broader access to my computer?
Answers
The safest approach is to back up only personal documents and photos, then wipe the system and reinstall Windows from freshly created installation media. Do not restore browser profiles, extensions, or unknown programs afterward. Update Windows and your applications before signing in again, and reinstall extensions only from their official browser stores after checking their permissions and reputation.
Reply to this answer
Sign out every session for email, gaming, chat, and shopping accounts, invalidate any backup codes that may have been exposed, and check account activity for new forwarding rules, filters, API keys, or connected apps. Warn your contacts not to open messages sent from your compromised chat account. Also report unauthorized trades or purchases through the affected services as soon as possible.
Reply to this answer
Treat the computer as compromised. A malicious extension can steal saved credentials, cookies, and active login sessions, which may let someone access accounts without knowing the passwords. From a separate, trusted device, secure your primary email first, then change passwords for important accounts, enable an authenticator app or security key for two-factor authentication, revoke active sessions, and remove unknown recovery methods or app permissions. Contact your bank or card issuer and monitor transactions if financial information was stored in the browser.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowCedar47: If reinstalling Windows is the only reliable way to be sure the computer is clean, I’ll back up only my personal files and do that before changing everything again.