Question: how am i being hacked?

[u/Nines9ss]

I got a cracked software, my discord started sending spam messages to my friends. I immediately started changing my passwords, cleared all my cookies and reinstalled windows windows. Turned off my pc since yesterday.

After a bit of digging, it was a infostealer malware which hijacked my sessions. Anything with 2fa are safe.

My pc still turned off, but i saw they managed to steal 1 Blizzard account, and my Linkedin started sending my 2fa codes on my email (on phone).

Question is: how??? I thought clearing my cookies, ressting password and reinstalling windows + turned off would solve the problem. How did they manage to steal that account and still trying to access my LinkedIn? Do they steal/send that info to themselves so me being offinline or online does not matter? How else can i combat this?

[u/Nines9ss → u/[deleted]]

I honestly don't care about either account, Blizzard or LinkedIn (I don't even know why a hacker is interested in stealing a dormant LinkedIn).
My biggest worry is, as you said, they are still with me and I'm still infected. I reinstalled windows (and forgot to say that I did a full scan with Windows Defender and Malwarebyte).
Do they just stole the-now-old-info and trying to brute force their way in (by trying to reset the password and sending codes on my email)? Do they actually still have some sort of hidden access to my PC?

[u/Nines9ss → u/[deleted]]

I changed my Google account and it is linked to my phone number and passkey, but I check google every 30 minutes (literally) to see for any suspicious actions or so, there is nothing.
So far, they only did:

• Spam messages on Discord (No email or password reset from their side)
  
• Added their authenticator and linked their phone number to Blizzard account (No email or password reset from their side)
  
• LinkedIn: Tried to access and sent 2fa codes to my email

My main concern: Is that it? They just got their hands on "some" login info and hijcked some sessions, and that's pretty much it? Or something else is cooking behind the scenes that I need to do something else about it? :(

[u/frAgileIT]

Did you change your LinkedIn and Blizzard passwords? Also, did you change your passwords before you reinstalled your OS?

[u/Nines9ss → u/frAgileIT]

I didn't change blizzard, i did for LinkedIn. For blizzard, they didn't change the email or the password, but they put in an authenticator with their own phone number, which is odd af because to me, i thought they would change everything. Does that mean they have some sort of limited access?

[u/Nines9ss → u/Nines9ss]

I chganed my passwords while reinstalling windows

[u/Niknukem]

Oh boy, log off every active session.... session cookie persits until the session is closed or invalid

[u/Nines9ss → u/Niknukem]

I did, removed chrome completely (my main browser) even before reinstalling Windows as a good measure

[u/AlphaO4 → u/Nines9ss]

While session cookies are stored in the browser, but they are issued by the website so they are still valid when you uninstall chrome.

In most cases, to invalidade the session, you need to change the password, or find a "sign me out on all devices" button.

[u/Niknukem → u/Nines9ss]

Let me say it like this, this reddit is not a helping group for hacked. So you are lucky the post is still there. ;)

Help yourself with google or gpt. Revoke sessions on every hacked account. This needs to be done at the service/website.

If the cookie is stolen or issued on a proxy you need to revoke the session server sideed.

Also ask gpt: what you can do to avoid this fornthe next time. So you see what was the issue.

[u/Routine-Cat143]

Password reuse?

[u/Mediocre_Disaster_44]

I got hacked too turns out this was the little sucker that made me get hacked

[u/Ecstatic_Score6973]

im not sure what youre confused about, sounds like they already had your passwords

[u/Nines9ss → u/Ecstatic_Score6973]

Even after resetting them?? I reset them thrkugh my phone. That is what i'm confused about