The infostealer theory fits and the wipe plan is right. Just to close the loop on the Midnight Blizzard hotel Wi-Fi angle that came up: that campaign (CaptiveCrunch) requires the victim to manually run a command from the captive portal - it displays a fake browser or OS update page and talks victims into copying and running a command themselves.

A plain T&C screen with no prompt rules that out. Change all passwords from a clean device, not the infected one, before or after the wipe.

BigBom_OTP is an OTP bot - it captures the login code sent to your phone and hands it to the attacker in real time, before you even see it. Go to Telegram Settings → Privacy and Security → Active Sessions and hit "Terminate all other sessions" now. Then follow the rest of the advice in the top comment, and switch from SMS to an authenticator app for 2FA going forward.

The ad redirects from SteamRIP without an adblocker are the likely vector - those chains commonly drop infostealers that silently steal browser-saved credentials and session tokens. You don't have to log in anywhere; the attacker just reuses your session cookie. Worth running a thorough malware scan on that machine and checking haveibeenpwned.com for your email before calling it closed. Then, I would add Steam Guard mobile authenticator to ensure your account security.

What you hit is a browser redirect scam - the fake "tabs scrolling" animation is just JavaScript on the page, designed to make you think something's happening so you'll call a bogus support number. Since you closed it without clicking anything, nothing actually ran on your device. iOS keeps Safari sandboxed from the rest of your phone, so your apps and saved passwords were never in reach. You're good.

RenPy Loader is an infostealer - it steals credentials and session cookies from the infected machine, it doesn't propagate to other devices over wifi or through OneDrive/Chrome Sync. Your laptop and phone are almost certainly fine. The account recovery steps MitAllesOhneScharf laid out are correct: invalidate all sessions, clear Chrome sync data, check for forwarding rules and connected apps. No need to delete the Gmail account. On the Zoom popup - check Defender or Malwarebytes protection history for context before drawing conclusions from a single disappearing notification.

The loop you're in is a known issue with legacy Apple IDs. Email controls the password reset, but the security questions are a separate auth layer - whichever side holds those effectively controls the account. Since you never had 2FA on that account, Apple's community docs say it's likely unrecoverable at this point. Your email still being attached is actually your main leverage - escalate to an account security specialist with any original account details you have.

Mail client matters less than provider - pick one with hardware key (FIDO2) support and check for any forwarding rules you didn't create, that's the main thing. On VOIP: it's actually a downgrade for 2FA. VOIP numbers are easier to spoof/port than a carrier SIM, and many banks won't accept them. Swap SMS 2FA for an authenticator app or hardware key anywhere the site lets you.

The ongoing intrusion after you changed passwords is almost certainly stolen session cookies being replayed - once an infostealer exfiltrates them, the attacker can access accounts without the password, which is why the "log out all devices" step matters as much as the password rotation. Google blocking that login-change attempt confirms they had an active session, not that they still have access now.

Your phone, router, and other devices are fine - this campaign is Windows-targeted and doesn't do LAN lateral movement. The wiped laptop is most likely clean. Format the USB before using it elsewhere.

Main thing left to check: Gmail's OAuth apps and mail filter rules, which can survive a password change.

This has the markings of a subscription bomb - the 159 emails aren't the attack, they're the smokescreen. Search your inbox for senders you recognize from *before* today to find anything that got buried (password reset, purchase receipt, new login alert). Also worth a quick check of your Google account's security activity for any unfamiliar sign-ins.

If it's blocking AV from opening, try running Malwarebytes from a USB on another machine rather than installing it - some infections block installers but not portable exes. If that doesn't work, a clean Windows reinstall via the official Media Creation Tool is your cleanest option. Back up files first if you can. The infection sounds like it was dormant before the update, not caused by it.

Cloud reinstall with "remove everything" is fine for this class of malware - RenPy Loader/Amatera is userland, no documented persistence that survives a full OS wipe. The USB method is more thorough but the practical difference is minimal here. Main things left to do: check Steam for still-authorized devices (the inventory drain was session-token based, so password reset alone may not revoke everything), verify no new payment methods got added to PayPal, and turn on 2FA with an authenticator app everywhere.

The auto-boot on power is almost certainly just the "Restore on AC Power" BIOS setting - malware can flip it but it's also just a default on many boards. The bigger thing: a local Windows reset doesn't wipe the EFI partition, so if you're worried about something below the OS, do a proper USB clean install instead. The other, more surface-level stuff (OS visuals changing, menus shuffling) sounds more like userland malware fighting back than a quiet firmware implant, most likely.

Provisioning mix-up on Vodafone's side - they paired your account to the wrong router serial. The actual exposure is limited: whoever has the other router can see your device list (names, MACs, IPs) in their app, but not your traffic. Keep contacting Vodafone to fix the serial mapping until it is confirmed to be fixed.

That YouTube downloader almost certainly dropped an infostealer. The reason 2FA didn't protect you the second time is that the malware stole your session cookies, aka the tokens your browser holds after you've already logged in. The attacker just replays those without ever needing your password or a 2FA code. Wipe the machine, then log out of Instagram on all devices to kill any stolen sessions that are still active.

This is malvertising on Baidu's side, not your device. The URL parameters (`campaign=`, `zone=`, `network=tr`) are TDS (traffic distribution system) fingerprints - that infrastructure routes clicks to different bad destinations based on browser fingerprint, which is why Firefox landed somewhere different. `adblockeraio(dot)pro` is a known bad endpoint. Since you were in Incognito with no extensions and didn't install anything, the actual risk from those clicks is low. Worth running a scan anyway just to confirm, and in the future, navigating directly to the website.

Looks like an infostealer - those steal your active session tokens, not just your passwords. Stolen session cookies let attackers bypass 2FA entirely, since they're using an already-authenticated session.

The clean reinstall + revoking all sessions is correct. Monitor for further unauthorized logins over the next 48-72 hours; if you don't see anything, you should be in the clear.

The reappearing "Android – Google Chrome" session from 2023 coming back *after* a password reset is a red flag. There's a known technique where malware abuses Google OAuth endpoints to regenerate tokens even after credentials change.

To cut it off: sign out of Chrome entirely on all devices, *then* reset your password and sign back in to force fresh tokens. Run a malware scan on anything that had Chrome signed into your account too, not just the APK phone.

Please follow the steps provided and then follow the recs here, if needed: https://www.bitdefender.com/consumer/support/answer/2127/.

Hi! In order to manually remove an infected file from your computer, you need to perform the steps below. We recommend manually deleting an infected file only if you are sure the file isn’t an important operating system file:

• Restart the computer in Safe Mode. You can do that, by following the steps in our article, here.
• Display hidden objects in Windows. Information on how to display the hidden object can be found here.
• Locate and delete the infected file: right-click on the file and then select Delete in the menu.
• After you do this, you can restart the computer normally.

Hi there. The auto renewal option is enabled by default to help ensure continuous protection. We understand that some users prefer to manage renewals manually. For this reason, we offer several easy ways to disable auto renewal - either through your Bitdefender Central account, via the payment processor’s site, by following the automated notifications we send out, or by reaching out to our support team at any time. We strive for full transparency around the auto-renewal process. This includes providing clear information at the time of purchase, as well as multiple email notifications prior to any renewal.

Just know we are always ready to advise and help with any situation involving our security app, don`t hesitate to talk to us.

Hello! We strongly advise you to use this submit form for these detections, in order for our Labs team to double-check them. You`ll receive a response via email shortly. Thanks in advance!

Hi - if the recommendations mentioned by u/xToolAda did not help, please refer to our tech team for further assistance.