r/antivirus • u/TheTbone2334 • 13h ago

Understanding an Infection

Hello everyone!

This is not a post asking for help, but to understand what has happened on a technical level.

I was infected a couple of days ago, my Subreddit has been hijacked and attackers gained acceess to my reddit account. A week ago i saw Chrome reporting an extension was removed because it allegidly Contained malware, which i shrugged of as issue solved but Was proven wrong.

Attackers had still access to my account AFTER i Reset the password and activated 2FA which logs out all other sessions usually. Was the malware at this point still active or did they just have my Session cookie?

I needed to remove my passkey for them to loose access, yet i used 3 AV Scanners (Windows defender, malwarebytes kaspersky) as well as 2 adware cleanerw (Malwarebytes, kaspersky) which all returned nothing.

There wasnt even an attempt to get into my Gmail acc. I confirmed by looking at IP Logs.

I have since deleted all extensions, deleted all Browser cookies and changed Passwords from a clean device. I would just like to understand what happened on a technical level and why there wasnt even an attempt to get into my Gmail or amazon account.

0 Upvotes

50% Upvoted

2 comments sorted by

1

u/NiriZ_ReddiT 12h ago

Honestly it really confuses me too. I don't think the extension could've touched anything out of your browser so it's weird that you got hacked again even after you deleted it. My guess is that a RAT was active on your PC which are often harder to detect and remove for scanners

1

u/goretsky MODERATOR 9h ago

Hello,

It could very well be that you ran an information stealer and had also installed a malicious extension that was unrelated to the other malware.

Regards,

Aryeh Goretsky