r/HowToHack • u/Abject-Lawfulness-49 • 4d ago

hacking Random Microsoft Attack

I dont need help with recovering anything just curious to know if someone has an idea on what happened to my account I dont understand, how come someone randomly attack my Microsoft account gets my code inside Email. Which he did not have access too? I went directly open it logged him out changed my stuff but while i kicked him out and was busy changing password, he used the same email to login my Steam, Epic Game, Discord. Managed to get my Epic and Discord which both of them were empty so nothing won xd. Recovered my Steam. Lol just curious if anyone has an idea how this could’ve happen i barely use microsoft or have anything to do with it how come?

0 Upvotes

38% Upvoted

22 comments sorted by

2

u/LongRangeSavage Programming 4d ago

You’ve installed/ran an info stealer. They export all sorts of information, including valid session tokens that allow them to bypass any need for credentials to access your accounts.

-1

u/Abject-Lawfulness-49 4d ago

Okay, firstly besides my phone the microsoft acc is nowhere linked into my pc. What i recently did is install forza4 from hydra then used this link https://savegame.pro/pc-forza-horizon-4-savegame/ -to mod it where i had to log in into microsoft via xbox. Played 17 hours nothing happend.
Then what i did just before it happend on my pc is tried to install this link

https://github.com/InfernalSlugKnife/CapCut-Pro-Studio-Suite

Tapped install into my folder nothing happened left it there.
These are basically my two suspects.
Just help me sort this out im freaking out where and how he had access

1

u/RolledUhhp 3d ago

I'm assuming you logged into that Microsoft account from your pc, which is the link between your pc and that account.

0

u/Abject-Lawfulness-49 3d ago

well he did not access my Pc tho, besides my email nothing else i found checked for every kind of background attack but nothing. Have to mention that my password and Email was listed on that leaked Archive thing back in 2024. So thats my guess idk?

2

u/RolledUhhp 3d ago

Brother you logged directly into your Microsoft account through a sketchy third party to use a service that has no reason to require that you're logged in to serve it's content.

Based on that alone I'm not convinced you did a thorough enough job cleaning up. You don't know what to look for, because if you did you would not have taken the steps that led you here.

I'm not taking shots, people get duped all day long.

It could have been the data breach, but you yourself thought the site was worth mentioning. The timing lines up, and it's the most likely culprit. Why would I dig through a dump hoping to find a user with poor security and accounts I'm interested in, if you'll just come to me and hand me your credentials?

1

u/Abject-Lawfulness-49 3d ago

So what do you suggest me to do? Especially on my pc i dont want anything to happen while i have no idea

1

u/LongRangeSavage Programming 3d ago

You need to log into every account you have and change the password. If you’re not using a password manager, now is the time to start. Every account needs a complex and unique password. Start with your email accounts. Check for any unknown logins and forwarding rules. If you’re absolutely certain it didn’t originate on your PC, you don’t need to format and reinstall Windows. If there’s any possibility, I’d recommend doing so.

1

u/Abject-Lawfulness-49 3d ago

can i contact u per dm just wanna ask some questions about this and leave u alone!! Please?

1

u/LongRangeSavage Programming 3d ago

I do not do DMs, especially in the InfoSec realm for various reasons. One of which is for the protection of people asking questions. I would never recommend taking questions to DMs when you are talking about any sort of security issues. You can end up in worse shape if someone takes advantage. I'm happy to answer any questions out in the open, though.

1

u/Abject-Lawfulness-49 3d ago

Okay so imma copy the same stuff i told someone else meaning the exact situation just want to know if you think this is why i got attacked or my other reason that my password were actually leaked on the archive back in 2024.

ive got nothing personal use it for gaming so no bank no private data what he hacked yesterday which i got back managed to kick and change everything strongly, but he got into an empty email with nothing on. Because ive got nothing on my pc to worry about what im worrying is where the attack came from. As i said youre the pro here. Installed Forza4 from HydraLauncher. Logged in with my microsoft as forza ask you to Xbox whatever, after that went took a savegame file where i changed my save data from game meaning User into his file. Where i had the full game and stuff thats all i did with his file transferred an user. Then it automatically changed from my microsoft into his one on Forza. So thats my only guess how he got that account. But on this way do you think he could access my Pc or only the microsoft? which he did but failed…

→ More replies (0)

1

u/RolledUhhp 3d ago

I would start with making sure that pc isn't connected to the internet, or your local network.

You want to change passwords to all your accounts, log out of active sessions on all devices, and make sure 2fa is enabled. This needs to be done from a DIFFERENT device.

Hopefully you don't have a bunch of personal stuff on your pc that isn't already (before the i cident) backed up somewhere else. You can try to quarantine files and back them up, but a clean OS install is a much better route.

No banking or logging into sensitive accounts on the same machine you play with dirty files on.

Google 'what to do if you download an informal stealer that started hijacking accounts' and prepare to learn a painful lesson on why this stuff can be a pain to rectify.

Be careful from here out. These schemes work because they target people who know enough to install cracked software, but not enough to know what they're really doing.

A good chunk of people that end up actually learning things in this field have all been in your shoes.

1

u/Abject-Lawfulness-49 3d ago

ive got nothing personal use it for gaming so no bank no private data what he hacked yesterday which i got back managed to kick and change everything strongly, but he got into an empty email with nothing on. Because ive got nothing on my pc to worry about what im worrying is where the attack came from. As i said youre the pro here. Installed Forza4 from HydraLauncher. Logged in with my microsoft as forza ask you to Xbox whatever, after that went took a savegame file where i changed my save data from game meaning User into his file. Where i had the full game and stuff thats all i did with his file transferred an user. Then it automatically changed from my microsoft into his one on Forza. So thats my only guess how he got that account. But on this way do you think he could access my Pc or only the microsoft? which he did but failed

1

u/RolledUhhp 3d ago

You downloaded a cracked game, and you used either that software, or the save game site, to log into your Microsoft account.

The software could be doing malicious things on your machine (reasonably likely). The site you logged into is probably where they got access to your email session. You also said you found your credentials in a leak. If that password was reused across accounts they pretty much had the keys to the kingdom.

There is a reasonable chance your machine is infected. If it were me, any targets that produced hits would be logged, with multiple hits getting priority. If I realized I had a session for your Microsoft account, and a likely password to try against other accounts, AND that you were the kind of user that would log into these accounts through a phishing portal - i would probably order a pizza and settle in for a good time.

Disconnect that machine from the internet, prepare a fresh bootlable USB ON ANOTHER DEVICE. Log into all of your accounts and rotate passwords ON ANOTHER DEVICE.

Boot into your fresh OS and start over.

If you're going to make this a regular occurrence you'll start to find ways to automate some of this, or you'll get better at avoiding it.

If it's free, you are the product. Assume every cracked file is dirty. Assume every 3rd party login is unsafe. Ask yourself why they would need you to be logged into your account to do whatever it is you're trying to do.

1

u/Abject-Lawfulness-49 3d ago

Since it happend and i managed to kick him from microsoft and change add every possible key and stuff. It never happened again. Why im assuming he couldn’t have had access to my pc is because i never had that microsoft account into my Pc. meaning whatever he tried to do yesterday with my email and pass didn’t match anything with my pcs ones. But yes the email and pass was the exact same one as in the leaks back then but as i said i never cared since they were basically empty.

So all he did was get into the accounts with the same password and email anything else stayed untouched.

Im guessing he got my passwords took em down found nothing and gave up?

Besides that my Pc acted normal i did not see any kind of suspicious thing which obviously he could hide but in this case he let me kick him meaning he wasnt a very good one.

He managed to log in but gave me time to change the pass and kick him out.

So idk what to say im no pro at this i just got this Pc and theres nothing to steal but just dont want anyone surfing around there.

Anyway any other tip or whatsoever would be helpful Thank you so much

Is it worth mentioning that the 3 platforms he joined with the same email pass
Microsoft, Steam, Epic game
had 3 different locations
Saudi Arabia, Bangladesh and the USA.

He aimed for these for what reason?

→ More replies (0)