My Discord account was compromised two days ago and used to send scam images. I recovered it, changed the password, and enabled two-factor authentication. Around ten hours later, my Instagram account was hacked as well, so I secured it the same way. Then I received an email saying a $200 Amazon gift card had been purchased. The order really appeared in my Amazon account, but Amazon canceled it before payment went through. I froze my card, moved money out of the spending account, and changed my passwords, including my email password. Since then, I've received suspicious-login alerts for another email account, along with unexpected Amazon login codes and a strange message from the account. Could someone have stolen browser session tokens or installed an infostealer? Should I disconnect and completely reinstall Windows, and what other steps should I take?
3 Answers
At this point, a clean reinstall is a reasonable precaution, especially since several accounts were accessed despite two-factor authentication. Use a different, trusted computer to create an official Windows installation USB, then perform a full wipe and reinstall rather than relying only on the normal reset option. Back up only essential documents and scan them first; avoid copying browser profiles, saved passwords, extensions, executables, or entire user folders because those could preserve the infection.
Also check whether the attacker created email forwarding rules, filters, new recovery addresses, unfamiliar passkeys, or app passwords. Review login history on your email and financial accounts, sign out everywhere, and remove unknown devices. If you reused any password—or used a similar old password—assume it is exposed and replace it everywhere. Two-factor authentication helps, but stolen sessions or already-authorized devices can sometimes bypass a fresh login challenge, so revoking sessions matters.
I hadn’t checked forwarding rules or connected apps yet. I’ll review those from a clean device and revoke anything unfamiliar before changing the rest of the passwords again.
The pattern is consistent with a possible infostealer or compromised computer, although reused passwords or an exposed email account could cause similar damage. Disconnect the computer from the internet and stop using it for account recovery. From a different, trusted device, change your primary email password first, then change every other password to a unique one and revoke active sessions, trusted devices, recovery methods, and app authorizations. Contact your bank and card issuers, monitor transactions, and keep working with Amazon through its official support channels.
Before reinstalling, save anything important such as photos or documents, but keep the backup minimal. After Windows is rebuilt, install updates and security software before restoring files or signing back into accounts.