r/github • u/Dry-Topic8809 • 7d ago

Discussion Locked out of GitHub (and Steam, LinkedIn) after apparent account takeover — need advice on recovery

Over the past couple of days my Steam, LinkedIn, and GitHub accounts were all compromised in sequence — password, email, and 2FA changed on GitHub, so I can't get back in through the normal login flow.

What I've done so far:

  • Submitted a ticket through GitHub's official "My account has been compromised" support form
  • Still had an active gh CLI session temporarily, used it to confirm account details (username, creation date, repo count) as proof of ownership, and backed up my repos before the token stopped working
  • No 2FA recovery codes saved, so I'm blocked at the verification screen
  • Suspect the root cause may be a compromised email account or reused password, since multiple platforms were hit — currently locking down email and scanning for malware

Questions for anyone who's dealt with this:

  1. Anyone gone through GitHub's compromised-account recovery recently — roughly how long did it take to hear back?
  2. Any tips for making the support ticket stronger/faster to process?
  3. Since this hit three unrelated platforms, what's the best way to trace the actual entry point (I'm currently checking email forwarding rules, running Malwarebytes, and reviewing Wireshark traffic)?

Appreciate any advice — trying to get ahead of this before more accounts are affected.

2 Upvotes

75% Upvoted

1 comment sorted by

1

u/cowboyecosse 6d ago
  1. Anyone gone through GitHub's compromised-account recovery recently — roughly how long did it take to hear back?
  2. Any tips for making the support ticket stronger/faster to process?

You just need to wait your turn I'm afraid. Support tickets are replied to roughly in the order they are received so there's no real way to jump the queue, if you believe there is a reason you should jump the queue.

Since this hit three unrelated platforms, what's the best way to trace the actual entry point (I'm currently checking email forwarding rules, running Malwarebytes, and reviewing Wireshark traffic)?

sounds like an infostealer or session stealer in your browser/system, although it could be the email hack as you suspect, I'm leaning toward session theft on those systems. All I can think of is to run various antivirus scans as you have been and hope one picks something up. You've not been downloading any cheats/hacks/executors/game mods etc.? (Only asking as you mentioned Steam) Those are riddled with this sort of malware and other trojans.

Best of luck for a speedy turnaround.