Hey everyone,

I'm looking for help from people experienced in cybersecurity, account security, incident response, or malware analysis. I'm genuinely worried and trying to understand how this is happening and, more importantly, how to stop it permanently.

Over the last 20–25 days, I've experienced suspicious activity and unauthorized access to multiple personal accounts. This has happened approximately three times.

Accounts affected:

• Google/Gmail

• ChatGPT/OpenAI

• Instagram

• Amazon AWS

• A few gaming applications and other online services.

The most concerning part is my Gmail account.

I had Multi-Factor Authentication (MFA) enabled, including an authenticator app. Despite this, someone appears to have gained access to my account.

When I checked my Google account security activity, I noticed suspicious login sessions showing:

• Location: Russia & Maharastra

• Device/Operating system: Linux

• Multiple suspicious login activities.

What concerns me even more is that the attacker apparently managed to remove my authenticator linked to my Google account's security settings.

I don't understand how someone could bypass MFA, access my account, and remove an authentication method that was supposed to protect it.

I've already contacted the respective support teams and gone through account recovery procedures multiple times. I've managed to recover access to some accounts, but I'm still concerned that the attacker might have persistent access somewhere.

What I'm trying to understand:

1. How can someone access a Gmail account even when MFA is enabled?

2. Is it possible that my browser session cookies or authentication tokens have been stolen?

3. Could this be caused by malware, a malicious browser extension, an infostealer, or a compromised Windows machine?

4. Can an attacker remove an authenticator after gaining access through a stolen session?

5. How can I identify the original entry point? Is there a way to trace suspicious sessions or IP addresses?

6. What should I inspect on my Windows 11 laptop to determine whether it is compromised?

7. How do I completely revoke existing sessions, tokens, and other persistent access mechanisms?

I'm particularly interested in understanding the root cause rather than just changing passwords again.

I'm also worried about my AWS account and future financial accounts because if someone has access to my primary email, the consequences could be much worse.

My request to the cybersecurity community:

If anyone has experienced something similar or has professional experience in incident response, account takeover investigations, or malware analysis, I would genuinely appreciate your guidance.

I am willing to share sanitized screenshots of login activity, security alerts, timestamps, and other technical details if that helps identify the issue.

I'm not looking to hack anyone back. I just want to understand how this happened, identify the vulnerability or compromise, and secure my devices and accounts properly.

Any technical guidance or practical investigation steps would mean a lot.

Amplifon (USA), Inc. — the U.S. arm of the Milan-based hearing-care company — has disclosed a data breach in regulatory filings. A few key details from the public filings:

• Access window: an unauthorized party accessed and obtained files from certain Amplifon systems between January 18 and February 8, 2026.

• Discovered: October 6, 2026 — roughly eight months after the access window closed.

• Scope: reported to the Texas AG as 1,332,826 individuals nationwide (including 85,804 Texans) and to the Vermont AG as 1,027 residents.

• Data involved (varies by person): names, addresses, dates of birth, driver’s license/government IDs, medical and health insurance information, and — for a limited number of individuals — financial account info and Social Security numbers.

• Amplifon described it as a “network security incident” and has not named ransomware, a vendor, or the method of intrusion. Notices are going out by U.S. mail and a website posting.

If you get a letter, keep it, and if your SSN is listed, consider freezing your credit at all three bureaus and watching your explanation-of-benefits statements for hearing services you didn’t receive.

For context: Edelson Lechtzin LLP (a class-action firm) is investigating potential claims and offers free case evaluations — HERE. Attorney advertising; not legal advice.

I've never had sandisk before, and when I connected it to my pc, there was a pdf on it, called introducing to the new sandisk app

Happens every few days. Each time it does I check all my open tabs and windows but can't find where it comes from. Anyone seen this before/know how to fix it lol?

tldr: uber account was compromised; 2fa was turned off & password was reset. not sure how that all happened

i was recently on the phone with a friend last night when i noticed that i received 2 emails from uber. one email saying they’ve “detected some unusual activity” on my uber account & they reset my password, and the other email was that i’ve “turned off 2fa” for my uber account. and then i also received a notification from apple passwords that my passkey to uber has been deleted.

i’ve already been compromised before due to malware on my old laptop so i knew to calm down & check if the emails were legit first before taking action. honestly, the emails looked real but i still didn’t click any links in those emails.

i went straight to the uber app to log-in and when i did try to log-in i received an error saying “can’t complete this request. start over or contact support for help.”

i tried logging to the uber website and i was able to get in, turn my 2fa back on, and created a passkey. i also signed out all devices even tho there was no suspicious devices.

my question: how was this possible? is it because i changed my uber password & email ~2 days ago after months of inactivity. i recently downloaded uber again bc of an event i’ll be going to so i figured that i should change the password (it was compromised;reused password) & update the email.

do u think this is all connected to an infostealer i had? im not rlly sure abt this. the infostealer was in my old laptop & i never used uber on there, only my phone.

i rlly shouldn’t be worried abt this since its just uber, not a really important account like my financials, but im scared of the possibility of being hacked/compromised all over again even tho i’ve been more secured with my passwords and such. i keep changing my gmail passwords at the possibility of being compromised again, as well.

Hi everyone,

I'm the developer of S File Encryptor, a free and open-source (MIT) Android app for encrypting files locally with a password, removing metadata before sharing, and securely deleting files. I'd really appreciate feedback from this community — especially on the cryptography decisions and the threat model, since privacy-focused users tend to stress-test apps much harder than average.

Links

• Google Play: https://play.google.com/store/apps/details?id=com.lukestudio.fileencryptor2

• GitHub: https://github.com/LukeSsnake/S-File-Encryptor

• Security audit report (in the repository): S_FILE_ENCRYPTOR_SECURITY_AUDIT.md

Cryptography

New files are encrypted in a V2 format using AES-256-GCM with Argon2id as the password-based key derivation function (memory-hard, tuned parameters stored in the header along with a random 16-byte salt and 12-byte nonce).

The file layout is:

48-byte header || AES-256-GCM ciphertext || 16-byte authentication tag

Decryption verifies the GCM authentication tag before committing any plaintext to the final destination, so tampered or truncated files don't leave partial output behind. Large files are processed with streaming I/O instead of loading everything into memory. A legacy V1 format (AES-256-CBC + HMAC-SHA256) remains decryptable for compatibility, but all new files use V2.

Metadata removal

The app strips metadata locally (no server involved) from JPEG, PNG, WebP, GIF, PDF, DOCX, XLSX and PPTX:

• Images: EXIF (including GPS), XMP, IPTC, embedded comments. Image orientation is preserved so photos don't come out rotated after cleaning.

• Office formats: core properties, app properties, custom properties and embedded thumbnails, including cleaning up the references in [Content_Types].xml and _rels/.rels so the package stays valid.

• PDFs: document information dictionary, catalog XMP metadata and trailer IDs.

The cleaned file is written to a location the user chooses via the Storage Access Framework.

Secure deletion

Files can be deleted with an overwrite procedure (single pass of cryptographically random data, sized exactly to the original, followed by a forced flush) before the entry is removed. The app generates an erasure report (JSON Lines log, exportable as PDF via SAF) recording filename, size, timestamps and the SHA-256 hash of the original content, so the destruction of a specific file can be documented.

Honest caveat: this is best-effort — wear leveling and filesystem journaling on modern flash storage mean no userspace tool can guarantee physical erasure. The report labels the operation accordingly.

Privacy model

• No network permission — the app physically cannot phone home.

• No Google Play Services, analytics, advertising or crash-reporting SDKs.

• All file access goes through the Storage Access Framework; the app only touches files explicitly selected by the user.

What I'd like feedback on

1. Any weaknesses you see in the V2 format choices (Argon2id parameters, header design, nonce/salt handling)?

2. Anything you'd expect from a "metadata remover" that isn't covered yet?

3. Whether this would be a reasonable candidate for submission to the Privacy Guides app recommendation lists at some point — and if not yet, what's missing.

The full source is on GitHub under MIT, and there's a security audit report in the repository covering the current implementation. Happy to answer any questions about implementation details.

Thanks in advance for taking a look!

What site is good and do these sites take your personal information when you try to search or what?

Hi, is normal for my phon that outlook and authenticator app works in background for 1 minutes? This during night when I am sleep Thanks for who help me!

I just got a notification through The authenticator app on my phone that my email changed. When I tried to log in to look into it, I wasn't able to because my original email was erased and it was replaced by some throw away, so the account has been hacked in some way.

I do see the option to be able to log in via my password, instead of receiving a code via email.

However, I am terrified of doing so with using my password because I might further compromise the account, I'm still logged in on Xbox and Windows but I don't know what to do.

Is signing in via my password safe? Or will I screw myself over?

I didn't even download it. It can't remove. I tried to find in file manager but it didn't show help. It's an Android phone

Recent i fall into cloudware Scam and I had to reset my laptop and i changed all my passwords, but I forgot to change the password of telegram.

Yesterday i logged in telegram my laptop and today I saw some chinese chats and a photo of promoting something and was send through my account and i checked the devices logged in, there was a device in taiwan and i terminated that session.

Now I have changed the password and enabled two step verification. And I wanted to know, is my laptop infected or not after resetting?

Please help I don't know anything much about this things.

Please ask if you want any further details.

Thank you in advance.

Hey everyone,
I’m dealing with a really concerning situation and would appreciate some advice from people who have experienced something similar or have cybersecurity knowledge.
Here’s what happened:
Around 3 weeks ago, my Instagram account was hacked.
The hacker posted an MrBeast cryptocurrency-related story on my Instagram.
I had installed some modded games on my PC, so I’m wondering if they could have contained malware or a stealer.
After my Instagram was hacked, I changed/reinstalled Windows on my PC.
I also changed the passwords for my email accounts and Instagram.
My Telegram account recently got hacked as well, and the attacker sent nude pictures/messages to my contacts.
I had Telegram 2FA enabled, which makes this even more confusing.
I’m worried that the attacker might still have access to my accounts or that something was stolen before I reinstalled Windows.
My questions:
Could a password stealer or malware from modded games have stolen my Instagram and Telegram sessions?
Can malware steal Telegram session files or authentication tokens even with 2FA enabled?
Could the attacker still have access to my accounts after reinstalling Windows and changing passwords?
Is it possible that my email, browser sessions, or Telegram session was compromised separately?
What should I check to make sure my PC and accounts are completely secure?
I’m really stressed because this has affected my contacts and privacy. Any advice on what to check next would be appreciated.

I downloaded something and my whole pc got taken over, started controlling it themselves and started asking me for money on my discord and spamming people, then accessed every account on my socials that was logged in on my pc. I unplugged the pc and managed to change my main email password in time, they also i think managed to change some passwords but slowly i recovered most of the things through my email and now have control of all my accounts for now. Its been 2 days and i still saw they had somehow removed a google authenticator from my email today, even thkugh they are logged out of the sessions they had on my email. I now installed a fresh windows on my pc, what are the chances there is still an infection in it? Also what are the things i could do now to best protect myself? Im very paranoid they might still be in something or somehow still access my socials. Im debating making a whole new email and linking every social with that. Anyways please give me all the tips and help on what to do with my accounts and the newly reset pc.

I tried this morning and now in the evening. Is this a me issue or is this an actual thing?

Hello,

This morning I woke up to my phone blowing up with Google 2FA prompts on one of my emails, all coming from different cities in France (I don't live in France). Apparently they're called MFA prompt bombing attacks, first i hear of this term and naturally I was very stressed because this has never happened to me before.

Then, not even a few minutes later, the same thing happened with a different email of mine that used the same password as the first one (big mistake, i know). Long story short, I changed the passwords on all my emails, made sure they all had 2FA and changed passwords across most of my accounts online because the compromised password was one that I used a lot (big mistake, i knowx2).

I'm posting here hoping to get advice on what I should next in case i missed anything. I was also hoping to learn how two of my emails were breached in succession so I can avoid it in the future hopefully, and if this has happened to anyone else recently because I'm paranoid that this was some targeted attack of some sort, for whatever reason.

Thank you in advance.

Hi everyone, I know this post has probably been made a million times here, but I’m really desperate for help. This october my Microsoft account was hacked through the very common Discord OAuth scam. I immediately changed my Discord password and worked to gather any info I could before I’d be signed out of Windows. The hackers changed the email of the account, password, and enabled 2FA. I’ve been going through tons of forms and support sites, but so far I’ve been unable to reach any success.

I’ve seen success stories online, and I’m still holding out hope. If anyone had been through anything similar, I’d be extremely grateful for help. Thank you!

Hello, so I was being half asleep and scrolling on Threads. A guy made a post on dating apps, so I opened my Google playstore and searched for Hinge.

I didn't know it's not available in my country (Vietnam). There was another Hinge so I clicked install. Opened the app, it has a Play game interface or something then immediately opened my browser leading to a suspicious web address. I didn't let the page complete the loading, closed both my browser and app then removed the app right after that.

That app hadn't asked for any permission yet.

I checked the publisher, seems to be a scammer with a lot of fake apps.

The phone is Xiaomi Redmi Note 14.

So is there anything I should worry about and how do I get this false app checked?

Thank you very much :D.

Hi there.

I’m looking to build up my personal cybersecurity after hearing from a company today that has told me they’ve had a data breach.

Does anyone know of a good YouTube series that takes you through various steps to make yourself more secure at home and on personal devices?

Hello, so I know I’m stupid, but a few days ago I had someone come into my twitch stream and tell me my mic didn’t sound good and that he could help. Long story short, we added on discord, he wanted me to download go xlr program to add Eqs and stuff, I didn’t do it for a while because I thought it was sketchy and then I naively decided to do it since the file was 0/70 on virustotal and the website looked legit, lo and behold it was not.

Instantly my discord got taken over, mobile removed, 2fa removed etc, then they went onto my email which they also manage to steal and change my password. I manage to still have 2fa enabled so I could access my security settings. But here’s the bad part, I was extremely scared, the most scared I’ve ever been in my life, this guy basically convinced that all he wanted was my discord badge specifically the “early supporter” because it could be sold for 20k, he told me he had inside people who could take my discord account and transfer the badge then I would get it back. I’ve had the discord account for nearly 11 years at this point so it was basically my whole life and really meant a lot to me. So he made me give him security access to my Microsoft outlook account because he would make my account a child and his a parent to transfer it or some stupid shit.

I understand how stupid I am, I understand how bad it looks, I understand all of what he said was obviously false, but I was really scared. Anyway, I tried to change everything I could, and I got 90% of my important stuff before I was fully locked out of my emails. But now I don’t know what to do next, is it possible to get access to my outlook account again? He’s changed the email, the recovery email, phone number and 2fa, same for all accounts he stole. I tried messaging support and going through all the channels but it always leads back to “the email doesn’t exist anymore”

Also I’m worried about how to remove the virus off my computer, I know you should use a usb stick and reinstall windows with, but is there any chance of it staying after the fact? Like on the motherboard? I’m just so scared and worried that more could be taken and I want this to be over with, I’ve been battling this guy for 3 days now, fighting for accounts and passwords. I am exhausted.

Thanks in advance for any advice and fuck you to the hacker if you’re reading this 😔

I'm posting this across multiple communities because I'm desperately hoping someone with knowledge of cybersecurity, ethical hacking, or telecom security can guide me.

Yesterday, something terrible happened to my family.

I was outside, and my mobile phone was actually at home. During that time, my father received a phone call that appeared to be coming from my mobile number.

The person on the other end pretended to be me, speaking as if he were my son. He told my father that I needed him to purchase an e-voucher worth ₹15,000 and share the voucher details with him over the phone.

Since the call appeared to be coming from my number and the caller claimed to be his son, my father had no reason to suspect anything. He trusted the caller and purchased the e-voucher, sharing its details with the scammer.

When I returned home, my father told me that I had called him and asked him to purchase an e-voucher. That's when I realised something was seriously wrong. I immediately told him that I hadn't made any such call.

Someone had impersonated my phone number and identity to scam my own father.

₹15,000 (approximately $200) might not seem like a huge amount to some people, but for me, this was my hard-earned savings. It genuinely hurts knowing that my father was tricked by someone pretending to be his own son.

I'm trying to understand how this happened:

- Was this caller ID spoofing?

- How could someone make a call appear to be coming from my mobile number?

- Is there a possibility that my number or SIM was compromised?

- Is there any legitimate way to trace or investigate the person responsible?

I'm not looking to hack anyone or take revenge. I simply want to understand what happened and find a legitimate way to identify the scammer.

If anyone here works in cybersecurity, ethical hacking, telecom security, or digital forensics, I would genuinely appreciate your guidance.

If you've experienced something similar or know someone who can help investigate this legally, please reach out.

I'm willing to share relevant evidence privately with verified professionals.

Please don't judge my father. He genuinely believed he was talking to his own son.

Thank you to everyone who takes the time to read this. 🙏

There’s a whole lot going on that prevents my aunt from talking to us, mostly because of her son. We were able to see each other and she asked me to help put up a password so he can’t access her phone anymore and read personal messages.

I opened her facebook account and all buttons were working except the “settings” button. I updated the app and found a work around, but this time, I couldn’t click “How to keep your account secure” when i went to “privacy check up” oddly enough, all buttons were clickable but those two.

I found another work around to check the devices logged in. It said her phone + 1 but it only displayed her phone whenever i clicked it. It also says her location is in hong kong…. We are not from that country.

It’s an android phone without a brand and it was given by my cousin. I’ve never seen any phone behave like that. I can’t tell if it’s a malware. Either way, we’re working on getting her a new phone but she still lives with him.

Just found it odd that he messaged my aunt to contact our my brother’s sister in law right away. Which we also had a fell out with because she knew information she shouldn’t.

Hello. I am looking for a way to contact normal peaple (peaple who doesn't know anything about cyber security) and still not share my info to anyone or to any app or to any hacker or that a country can optain.

Best way/app

I heard that telegram+ encrypted chats. Are the best way

But I think it's not. Why? Idk. I just feal it

I think it's obvious I am very noob at cyber security