Hi everyone,
I’ve implemented strong security measures like 2FA, password managers, and even security keys to protect my accounts. Despite all this, I’ve still experienced hacking incidents that don’t seem to fit common explanations like session hijacking or phishing.
I’m trying to understand what advanced attack vectors or vulnerabilities might be at play here, and what steps I can take beyond the usual advice to secure myself better.
Has anyone faced similar issues or can share insights on deeper cybersecurity operations, attack methods, or advanced defenses? What should be the next steps when standard protections fail?
Thanks in advance for your expertise!
You must log in or # to comment.
It really depends what kind of attacks you are experiencing. Account stealing? Data loss? Financial theft?
Are we talking personal or enterprise?
I’m facing repeated personal account hacks on platforms like Instagram, Facebook, and Discord (twice). I described the situation and asked Discord support for help, but they only recommended the usual security measures and then closed the query as resolved.
In the case of Telegram, everything I built was compromised, and the attacker even joined some Russian channels using my account.
I’ve asked the same question on Defcon Discord and other places but received no answers. I also tried Reddit’s cybersecurity community, but nothing there either.
Keylogger or trojan. You need a fresh install is my guess.
I agree, but a fresh install may not be enough. Try to identigy the compromised device y feeding each device access to different accounts to see which get compromised.
There are techniques for keyloggers and trojans to survive fresh installs. A screwdriver or hammer may do a better job.
Good luck, stay safe!
Are you accessing these through your web browser? If so, do you check the “Leave me logged in” button enabled?
As others have suggested, maybe your OS is compromised and the attacker is stealing those authorization cookies from your browser and/or dedicated clients (ie: discord).
You might want to log out of all your other browsers/clients and either try something like LibreWolf (maybe the portable installation) and configure it to remove cookies or use incognito sessions.
The other suggestion (rather then doing an immediate reformat - as others have suggested) would be to create a second windows account and see if that improves the situation.
If you do decide to reformat (and keep windows), I’d suggest using windows pro (you can buy a grey market license, if the price is too high and you’re okay with the moral and technical risks). As windows pro allows you to have multiple users. Then create an Admin user, which you will only use to create a non-admin user for yourself, as your daily driver account.
You can still use the non-admin user to install apps, but each time you’ll need to type in the Admin password. It basically turns windows into a quasi “Ubuntu sudo” access. The upshot is that if your non-admin account is compromised, your OS should still be rather secure and you can use the Admin account to either explore the compromised account or create a new non-admin account.
Good luck
You might have a trojan or keylogger somewhere in your network
Can anything be done about this?
Run virus scans on your systems. Preferably with a live ISO where possible
Wipe and reload the OS.
Depending on the level of paranoia, get a new computer or a different manufacturer. Patch the device on a public network before bringing it home.
there is no perfect security.
There will always be a flaw, an exploit, a back door, a man in the middle, etc etc etc
imho, and i’m sure people will disagree, but I think all of its kinda pointless exercises to make up for the fact that end users are typically idiots that keep making passwords like “password1”, and as a result creates immense false sense of security.
Also it doesn’t matter how good your password manager is if the site you’re logging into gets hacked
especially if they take proper practices for PW storage… which alarming many dont
You’re using very secure options for a few specific areas, but security is about being systematic and comprehensive. There’s a lot of complexity, so a lot of potential holes. You probably don’t need better security on the places you already make good choices, you need to find a way to cover more possibilities.
If you’re talking about cloud accounts, there’s not much else you can do: it’s al up to the vendor.
Minor possibility: I use unique generated email addresses/usernames, in addition to unique generated passwords or passkeys. There’s authentications are hard to guess, different at every site, intruders can’t even easily connect my accounts at different cloud vendors
Could you maybe suggest some services and explain their usage in more detail? That would be more helpful than having me research and potentially choose the wrong one.
Probably not. It’s an Apple thing that comes with iCloud. iPhones aren’t very popular here but maybe someone else can recommend generic/Android/Windows/Linux equivalents
This might even require a specific level of iCloud subscription, I don’t know, but I use
- password generator, including family sharing and cross device sharing. I believe even cross device passkeys but I’ve never tried
- “Hide my email” generates a unique forwarding email per site
- “private relay” maps me to a general location not tied to my mobile vendor
Whether through an app or web browser on any Apple or windows device, it autofills a login with unique generated email, unique generated password or passkey, and anyone trying to find my location through my connection will get a regional answer
For example, my login here is a unique address not used anywhere else and not tied to me any other way.
The term “hacking” gets tossed around to describe all kinds of different behaviors that may each require a different level of response.
You’ll get more specific help by providing more specific symptoms/behaviors.
Infostealer malware can steal session cookies, which an attacker can then use to interact with online accounts completely bypassing the password and MFA.
If you have a keylogger, everything you type in might be intercepted. Ditto for anything pasted to your clipboard.
To start, you need to make sure you have a trusted OS environment - that means wiping and reinstalling the OS using installation media that was prepared from another trusted device - not your potentially compromised device.
From there, you would have a trusted place to change all of your passwords. While in the security section of those online accounts, you would want to revoke all existing sessions. Some services have a “sign out everywhere” function, others may require manual review of each session.
If you have an email account that was compromised, be sure to check the mail forwarding settings.
For SSO accounts, audit your list of connected apps and services. Revoke and reinstate access for anything that can be set up again (e.g Google Drive Desktop App)
If you’re placing your MFA, passwords, and security keys into the same password manager: this would be an ideal attack vector.
…also, if you’re keeping your MFA separated from you passwords, but using the same technology (ie: two accounts: one for MFA and a second for passwords, both stored in bitwarden/vaultwarden): that technology could be an attack vector (ie: a weakness in the client or browser extension).
Your assumption is partly correct regarding storing passwords and passkeys in Bitwarden. However, my MFA is managed separately through Google Authenticator, and the recovery codes are stored in a separate account that itself is protected by multifactor authentication, including access only via a hardware security key.
Additionally, my Bitwarden account is secured with a 32-digit random master password, multi-factor authentication, and a security key.
So while I understand the potential attack vectors you mentioned, I’ve taken steps to keep these components isolated and strongly protected.
deleted by creator
What OS and browser are you using? What browser extensions do you have installed?
I use Windows and primarily browse with Edge, Chrome, and Firefox. For Gmail and mail-related activities, I use Brave.
Win 11? I’d do a clean OS install (I highly recommend LTSC, if you must stick with Windows). But definitely format and reinstall OS. If that’s too much effort, check your browsers for rogue extensions and do a full virus and malware check. Clear all browser data and start fresh. I highly recommend using only Firefox, Chrome if the site doesn’t work, and never touch Edge or Brave. Definitely just uninstall Brave. Once you’re confident your OS and browsers are clean: start with a new password manager database and change your passwords.
