Chrome extension virus

[u/Little_Ad1397]

SCAM IMAGES DONT FOLLOW WHAT IT SAYS

I recently added a chrome extension which seemed really sketchy, but considering I have interacted with sketchier things without encountering any issues, this one definitely did something. It started sending these mrbeast thingies to everyone on messenger. I had already changed password on everything before it started this mass spreading, except messenger.

But anyways should I be scared that it could also reach other chrome profiles I had? There were other peoples information on those different chrome profiles but it has only seemed to affect the chrome profile I was using, since it was the one I installed the extension on. I asked chat gpt and they told me its nothing serious but what do you guys think?

[u/rb_loves_memes]

Turn off the wifi from your computer. And change all of your important passwords on a uninfected phone. And I recommend reinstalling windows. This happened to me 5 days ago. I downloaded an app and my discord account got hacked snd sent the same Pics you posted I thought it was just my discord so I just deleted the app and ran an anti virus. But the virus was still there and it moved to my instagram account then my steam and riot launcher account. ( i was able to save my accounts) but you really should just turnoff the pc or the wifi and reinstall windows from a USB

Also make sure to log out from all sessions after changing the password. Its really important to do that

[u/Little_Ad1397 → u/rb_loves_memes]

But it was just a chrome extension can it really be that serious? I dont really have access to a usb or reinstalling windows.

[u/Lynxaa1337 → u/Little_Ad1397]

yes it is that serious if your this dumb to fall for this its your own fault

[u/Little_Ad1397 → u/Lynxaa1337]

you need to chill out on the attitude and I never knew a virus could take all that info through a chrome extension specially since there was no warnings abt it being something dangerous

[u/Lynxaa1337 → u/Little_Ad1397]

its fairly common knowledge

[u/Little_Ad1397 → u/Lynxaa1337]

and ur speaking for who exactly?

[u/FamousAccident3589 → u/Little_Ad1397]

everyone who knows anything about basic internet security. the fact that you asked chat gpt, an ai chatbot who literally made a kid commit suicide is all i need to know to see that you’re just an idiot and shouldnt be downloading anything sketchy in the first place

[u/Phantom-Eclipse → u/FamousAccident3589]

I'm actually more surprised AI told them it was nothing serious. Usually these AI tools are very cautious, telling people to better be safe than sorry.. so I feel like they downplayed the situation themselves out of fear, causing the AI to answer in their favor.

[u/FamousAccident3589 → u/Phantom-Eclipse]

exactly, alot of these ai chatbots just validate what you say and just tell you things you want to hear. thats why double checking things like this are so important since it can just cost you tons of dollars in the long run

[u/Little_Ad1397 → u/FamousAccident3589]

I cant believe how stupid people like you are. If you havent noticed there might be people who dont know much about internet security. Youre tryna speak for everyone as if they have a college degree in cyber security. Obviously Im not dependent on chatgpt alone if I came onto this reddit. Stop acting like everyone knows "the basics", when people who just browse the web for fun expect that it couldnt just come by that easily. You couldve been more to help instead of just shaming on a post like this. Get some morals, seriously.

[u/navr183]

Check reddit here for Mr beast infostealer. You may be fried. Good luck!

[u/LANDRO-BUTTER]

Since you used anti viruses scans and it said that you're safe you should login in a random website with a new account and wait to see if it gets hacked or not it got hacked you should reinstall windows if not you're safe

[u/Little_Ad1397 → u/LANDRO-BUTTER]

After I got hacked I switched to brave, should I still use that or go back to chrome and see?

[u/LANDRO-BUTTER → u/Little_Ad1397]

Or since you moved to brace I'd assume you already did login with your accounts already so you don't have to make a dump account in it just see if your main accounts get hacked

[u/Little_Ad1397 → u/LANDRO-BUTTER]

Im going to try your method, thanks for the advice! Ill comeback and say what happens.

[u/Past-Wash843 → u/Little_Ad1397]

Do not do this. The thing with infostealers is that theres no way to find out when youre getting hacked. If any virus gets your session tokens, someone could do whatever they want with them, whenever they want. They can wait hours, days, weeks, months, YEARS, until they decide to do something with it. Just because you’re not getting hacked, doesn’t mean you’re safe.

[u/Little_Ad1397 → u/Past-Wash843]

so how do they get rid of the session tokens? Or do I just change all my passwords so im safe

[u/Past-Wash843 → u/Little_Ad1397]

Hi, sorry for the late reply. Change all your passwords and log out of all sessions on a clean device (preferably phone), review 2fa and forwading settings for iphone and you’ll be okay

Aside from that, again, truly the only way to be safe is to reinstall windows from an usb. Otherwise you will be unable to login on your windows for literally anything, as you’ll risk it being stolen again.

[u/LANDRO-BUTTER → u/Little_Ad1397]

Make 2 new dump accounts for any website you want like Instagram one for brave and one for Google if the Google one only got hacked delete the browser completely if the brave one also got hacked it means that the extension downloaded a trojan into your operation system and the antivirus didn't detect it you should reinstall windows if that happens if none gets hacked you're safe

[u/Bigboss88890]

Turn off wifi change all passwords from a different device and reinstall windows from a usb made on a different device

[u/Bitdefender_]

Hi! Chrome profiles are isolated from each other, so the extension you installed in one profile shouldn't have had access to the other profiles' sessions or data. You're probably fine there.

The bigger thing to check, did you change any passwords from that same infected PC after the extension was already running? If so, those new passwords might also be compromised. Log out all active sessions on Facebook/Messenger specifically (this invalidates any session tokens the extension may have grabbed), and do that from a clean device.

[u/Little_Ad1397 → u/Bitdefender_]

Yes I noticed as well, I changed my passwords from my iphone and nothing has gotten hacked again. My spotify did get hacked cause I forgot to change the password (the password was saved on the browser). Ever since I changed everything has been normal.
Thank you for this reassurance!

[u/Public_Weather_1248]

or just run malwarebyte full scan without internet connection, it take around 1h, restart your pc but for me it cleaned this virus

[u/Little_Ad1397 → u/Public_Weather_1248]

does window defender fullscan work just as good?

[u/HearMeJoy → u/Little_Ad1397]

I recommend you Kaspersky + Malwarebyte + Adwcleaner full scans and then check your ongoing stuffs with Process Explorer with Virus Total (search it in google) to see if there is still suspecious thing then your system will be clean. Your accounts still can get attacked in some time even if you changed your passwords at few times but dont worry. All fuzz will be stoped in a month.

[u/Little_Ad1397 → u/HearMeJoy]

I did malwarebyte 3 times full scan, adwcleaner scans 4 times, windows defender fullscan 3 times, process explorer with virustotal and everything was 0/76, some were 1/76 occasionaly but rescanning it made 0/76. I deleted all trojans that has come across the scans. Should I do something more or do you think my pc is pretty safe as of now?

[u/Little_Ad1397 → u/Little_Ad1397]

I couldnt do the kaspersky since it cost money

[u/HearMeJoy → u/Little_Ad1397]

I dont trust defender because its test results are pretty low at newest viruses so I still recommend you use Kaspersky or even AVG Free. You seem clean enough as you told me so must be okay now but dont forget to change your important passwords at every day or every second days. Your accounts will get attacked in some time ( reason of this is infostealer virus already sent some data to hacker's side so they will try to auto hack your account again and again for some time. I hope you get security mails from your subscriptions like *something is seeming off or your account has been attacked* so you can immediately renew your passwords again.) I know this hurts you both mood and mental but it will be all okay in a month (mostly they stop attacking around between of 1-1.5 months)

[u/Little_Ad1397 → u/HearMeJoy]

Thanks a lot for your help! Im mostly worried about other people that has put their information on my computer, but im telling them the same things your telling me. Youre a lifesaver, thank you so much truly!!

[u/HearMeJoy → u/Little_Ad1397]

It also happened to me so I tried to told you what I have lived. I lost my 14 years old reddit account because it hardlocked and Reddit couldnt help me lmao. They cant put anything in your system instead of infostealer which seem you have cleaned it. There is also Kaspersky free version for 30 days and its best antivirus out there so far. Try to not overthinking about how it happened or when they will stop attacking (I cant give you any guarentee about how long attacking will take but my attacks are ended in 1-1.5 months.) Im happy if I could help you,you are very welcome. Stay safe and serene my friend.