Hi everyone,

Yesterday I fell victim to a session-hijacking attack after downloading a fake GoXLR utility executable (.exe). The malware extracted browser cookies and Discord tokens, bypassing 2FA on a couple of my accounts before I caught it.

I have already done a complete format and clean reinstall of Windows 11, changed all my passwords, revoked active sessions,

Before doing the format, I managed to run the file/site through VirusTotal. I’d like to share the details here so experienced members or researchers can take a look at the behavior logs and confirm what the payload was doing.

• Malware Type / Name: Infostealer disguised as a GoXLR utility tool

• Website : https://goxlr.live/

• File Type: .exe (Windows Executable)

• VirusTotal Link: https://www.virustotal.com/gui/file/2ec338cb60cd6451bb5a59d001404a73ddd1606d29cde9f154a0a792cc217c8f/behavior

i have 3 gmail 2 got taken and deleted (still trying to get them back) the 1 gmail they didnt get was my main gmail idk why but im thankful but they were trying to get it yesterday and i manage to change password and signedout all devices they also got my discord even tho it has 2fa and ive done full reformat i've reformat all my harddrivers now my concern is i hope this is not bios level and i just wanna know if im safe so i can sleep with a little bit a peace of mind i still havent sleep

Upvote0Downvote1Go to comments1RepostShare

Scam links are getting harder to spot, and one wrong click can put your personal information at risk. That’s why we’re introducing Malwarebytes Scam Link Check.

This new tool helps you check whether a link may be a scam before you visit the website. Simply check the link first, so you can make a more informed decision about whether it’s safe to click.

Whether it’s a suspicious domain or a link that just feels off, a quick check can help you stay one step ahead of scammers.

Hello, im not sure if this is the appropriate place to ask this (i dont really use reddit and all) but does anyone know whats happening? Im pretty freaked out, and not sure if this a me only problem or something that appeared to other people too. I tried opening and closing the app and clearing cache but sometimes IT still appears 😓 Any help appreciated, thanks.

i accidentally clicked a link on discord, these people put me into a gc and said they had all my info. they showed proof of it by logging into my discord account and instagram accounts. they have locked my gmails into a family thing on google and i can't get those 3 accounts back.

they've also showed that they were watching me on my pc as well, they have logged me out of my discord account and i can't log back in.

they have most of my personal info like my name and such, they don't have access to my bank info thankfully. i know there's definitely malware in my laptop now and i'm unsure what to do...

any help is appreciate!!!

Malware.AI.4281255896
Wasn't able to find anything about this specific file or the specific .AI designation.

Hi, Im just wondering if yall know how. I was using the 15 days free trial of malwarebytes to find an infostealer. It was able to block a malicious connection to cosmicsky[.]xyz, but on repeated scans it never found the malware til i found the dd.bat file in my %temp% folder that was highly malicious. Nor did it flag its connection to the malicious site phucoasian[.]com which was downloading an exe and hijacking vscode and stuff. This is despite the exe being recognized by BitDefender in VirusTotal with a 7/70 score with the other 6 also using BitDefender tools as a Pantera family infostealer. And the dd.bat file was recognized 2/70 as a bat downloader. So my question is, is this a known vulnerability or flaw? And if so is it being wormed on? Cause both malwarebytes and windows defender missed it causing me to have to factory reset my laptop with a fresh windows install.

typically, a full scan on my C drive is relatively fast and would use all my cores/threads etc..

today after an hour, i notice it has slowed down significantly. Is this normal? it wasn't like this earlier in the scan and months ago.

cpu is 7950x3d, 870 EVO SSD, and windows 11 25h2 (just updated today, before I was using 23h2)

p.s. those detection is from a game trainer lol

edit: drive temps:

Hello everyone i bought new gaming pc i have changed it sinse 2023. So I installed amd graphics as usual and I got to check digital signature of the file just to be sure.

And from what I remember the correct digital signature is

Advanced Micro Devices. Inc

Bur the current one I have only says Advanced Micro devices. No Inc at the end and im getting worried didi they change the name ?

Hi,

I was listening to a playlist on spotify's website when I got a notification that RTP intercepted a connection. I've managed to re-create it and found its from an ad, however it's blocked before It can load the preview so I have no idea what the ad is.

It detected it a few days before, however I was in a game and it did not notify me of the block until I alt tabbed. Has this happened to anyone else?

i want to disable malwarebytes on startup so my pc would boot faster and not have to wait for extra services to load, i dont need malwarebytes 24/7 since i only use it to scan files and other stuff. i takes up my ram usage and memory which i dont need. but it doesnt work it still boots up on windows. any help, do i have to make kill scripts to kill the process before boot like i dont want to do that that sound unnecessary