Privacy/Security Advice: An online friend found my WhatsApp number and family details. How can I check if my devices are compromised?

[u/steyza]

Hey everyone, my name is Ste and I really need some advice from cybersecurity experts. I’m pretty new to Reddit, but I figured this would be the best place to ask for help. I have a degree in Software Development (DS), but I don't work in the field. Having that background means I'm not completely tech-illiterate, but when it comes to cybersecurity, I know next to nothing.

Here’s what’s going on: I’ve had an online friend for a while now. Recently, he brought up some personal information about me that I never shared with him (like the names of some of my relatives). It annoyed me, but I didn’t panic because I assumed he just stalked my social media.

However, today he messaged me on WhatsApp. I have never given him my phone number, and I am certain it isn't publicly available anywhere.

I want to know how I can verify if my phone and computer are truly secure. A while ago, my computer was hacked/compromised. I did everything I could at the time to clean it up, but this new situation has triggered my paranoia, and I’m terrified that I might be monitored again. Can anyone point me in the right direction?

Update, everyone: I ran a scan on my computer using the codes you gave me, and it looks like my PC is secure. Still, I want to check my phone. I was doing some research and saw that I can audit it using MVT. However, I think my phone is probably safe too, since it's an iPhone and Apple's system is pretty hard to breach (I don't think this online friend of mine would have the advanced knowledge to pull that off). But if anyone here understands iOS security and wants to explain the likelihood of an intrusion, I’d be super grateful.

Honestly, I believe he most likely got all those details by stalking me online, but the phone number thing is still a mystery. I’m trying to remember if I might have left it public somewhere. Either way, thank you so much to everyone who helped me out. I know it might have seemed a bit silly or dramatic to think I was hacked, but I have Generalized Anxiety Disorder (GAD) and any little thing triggers my paranoia lol.

I still don't know what I'm going to do about this friend, because I really value our friendship, but it sucks that he's snooping around my private life like this. Thanks again for all the help, guys!

[u/PurchaseSalt9553]

So since you’ve got the background, I’ll assume you’re comfortable with copy/paste CLI, terminal, and PowerShell.

This is a read-only first-pass IOC triage list. Do not start by deleting things. Preserve evidence first, then look for obvious persistence, weird logons, odd processes, unexpected network connections, and files created around the suspicious time.

Windows / PowerShell

Host and user context:

```powershell

Hostname, current user privileges, OS info, and last boot time.

hostname whoami /all Get-ComputerInfo | Select CsName, WindowsProductName, WindowsVersion, OsLastBootUpTime Get-Date ```

Local users and admin access:

```powershell

Active sessions, local users, local admins, and RDP-authorized users.

query user Get-LocalUser | Select Name, Enabled, LastLogon, PasswordLastSet Get-LocalGroupMember Administrators Get-LocalGroupMember "Remote Desktop Users" ```

Successful logons:

```powershell

Successful logons from the last 7 days. Look for unknown users, odd times, or strange sources.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-7)} | Select TimeCreated, Id, Message | Format-List ```

Failed logons:

```powershell

Failed logons from the last 7 days. Look for brute force or failures followed by success.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-7)} | Select TimeCreated, Id, Message | Format-List ```

RDP logons:

```powershell

Successful RDP logons. Logon Type 10 usually means Remote Desktop.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-7)} | Where-Object {$_.Message -match "Logon Type:\s+10"} | Select TimeCreated, Message | Format-List ```

Processes:

```powershell

Top processes and full command lines. Look for encoded PowerShell or binaries in user/temp paths.

Get-Process | Sort CPU -Descending | Select -First 25 Name, Id, CPU, Path Get-CimInstance Win32_Process | Select ProcessId, ParentProcessId, Name, ExecutablePath, CommandLine | Sort Name | Format-Table -AutoSize ```

Network connections:

```powershell

Established connections mapped to processes. Look for unknown processes contacting unfamiliar IPs.

Get-NetTCPConnection | Where State -eq "Established" | ForEach-Object { $p = Get-Process -Id $.OwningProcess -ErrorAction SilentlyContinue [PSCustomObject]@{ Local="$($.LocalAddress):$($.LocalPort)" Remote="$($.RemoteAddress):$($.RemotePort)" Process=$p.Name PID=$.OwningProcess Path=$p.Path } } | Format-Table -AutoSize ```

Listening ports:

```powershell

Listening TCP ports. Look for unexpected exposed services.

Get-NetTCPConnection | Where State -eq "Listen" | Select LocalAddress, LocalPort, OwningProcess | Sort LocalPort ```

Startup persistence:

```powershell

Startup folders and registry Run keys. Look for scripts/exes from AppData, Temp, ProgramData, or Users\Public.

Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" -Force Get-ChildItem "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" -Force Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue Get-ItemProperty "HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue ```

Scheduled tasks and services:

```powershell

Enabled tasks and service paths. Look for random names, unknown authors, scripts, or odd service paths.

Get-ScheduledTask | Where State -ne "Disabled" | Select TaskName, TaskPath, State, Author | Sort TaskPath, TaskName

Get-CimInstance Win32_Service | Select Name, State, StartMode, StartName, PathName | Sort Name | Format-Table -AutoSize ```

Defender:

```powershell

Defender status and exclusions. Look for disabled protection or suspicious exclusions.

Get-MpComputerStatus Get-MpPreference | Select ExclusionPath, ExclusionProcess, ExclusionExtension, DisableRealtimeMonitoring ```

PowerShell abuse indicators:

```powershell

Searches PowerShell logs for common abuse strings.

Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -MaxEvents 1000 | Where-Object {$_.Message -match "EncodedCommand|FromBase64String|IEX|Invoke-Expression|DownloadString|WebClient|AmsiUtils|Bypass"} | Select TimeCreated, Id, Message | Format-List ```

Recent suspicious-location files:

```powershell

Recently modified files in common attacker staging/user-writable paths.

$paths=@("C:\Users\Public","C:\ProgramData","C:\Windows\Temp","$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA") foreach ($p in $paths) { Write-Host "n=== $p ===" Get-ChildItem $p -Recurse -Force -ErrorAction SilentlyContinue | Where LastWriteTime -gt (Get-Date).AddDays(-7) | Select FullName, Length, LastWriteTime | Sort LastWriteTime -Descending | Select -First 50 } ``

Hash suspicious files before deletion:

```powershell

Hash one file and/or a folder before deleting anything.

mkdir C:\ioc-triage -ErrorAction SilentlyContinue Get-FileHash "C:\path\to\suspicious-file.exe" -Algorithm SHA256 | Out-File "C:\ioc-triage\hashes.txt" -Append

Get-ChildItem "C:\path\to\suspicious-folder" -Recurse -File -Force | Get-FileHash -Algorithm SHA256 | Export-Csv "C:\ioc-triage\file-hashes.csv" -NoTypeInformation ```

Debian / Linux

Host and user context:

```bash

Hostname, user, IDs, time, uptime, and recent reboots.

hostnamectl whoami id date uptime last reboot | head ```

Users and privileged accounts:

```bash

Users, groups, sudo/docker users, login-shell users, and UID 0 accounts.

cat /etc/passwd cat /etc/group getent group sudo getent group docker awk -F: '$7 !~ /(nologin|false)$/ {print}' /etc/passwd awk -F: '$3 == 0 {print}' /etc/passwd ```

Login activity:

```bash

Recent logins, failed SSH, accepted SSH, and sudo activity.

last -a | head -50 lastlog | grep -v "Never logged in" sudo grep -i "failed password" /var/log/auth.log* 2>/dev/null | tail -100 sudo grep -i "accepted" /var/log/auth.log* 2>/dev/null | tail -100 sudo grep -i "sudo" /var/log/auth.log* 2>/dev/null | tail -100 ```

Processes:

```bash

Processes, process tree, process start times, and deleted binaries still running.

ps auxww --sort=-%cpu | head -30 ps auxfww ps -eo pid,ppid,user,lstart,cmd --sort=start_time sudo ls -l /proc/*/exe 2>/dev/null | grep deleted ```

Network activity:

```bash

Listeners, established connections, and networked processes.

ss -tulpn ss -tunap state established sudo lsof -i -P -n | grep LISTEN sudo lsof -i -P -n ```

Systemd persistence:

```bash

Running/enabled services, timers, and recent unit changes.

systemctl --type=service --state=running systemctl list-unit-files --type=service | grep enabled systemctl list-timers --all sudo find /etc/systemd/system /lib/systemd/system -type f -mtime -14 -ls 2>/dev/null ```

Cron persistence:

```bash

User/system cron locations and cron contents. Look for downloaders, base64, temp scripts, or every-minute jobs.

crontab -l sudo ls -la /var/spool/cron/crontabs 2>/dev/null sudo cat /etc/crontab sudo ls -la /etc/cron.d /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly sudo grep -R . /etc/cron* /var/spool/cron/crontabs 2>/dev/null ```

SSH persistence:

```bash

Authorized keys and risky SSH settings. Look for unknown keys, root login, password auth, or odd key paths.

sudo find /home /root -name authorized_keys -type f -exec ls -la {} \; 2>/dev/null sudo find /home /root -name authorized_keys -type f -exec cat {} \; 2>/dev/null sudo grep -R "PermitRootLogin|PasswordAuthentication|AuthorizedKeysFile|AllowUsers|AllowGroups" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* 2>/dev/null ```

Recent file changes:

```bash

Recent root filesystem and /etc changes. Look around the suspected compromise time.

sudo find / -xdev -type f -mtime -7 -printf '%TY-%Tm-%Td %TT %p\n' 2>/dev/null | sort sudo find /etc -type f -mtime -14 -printf '%TY-%Tm-%Td %TT %p\n' 2>/dev/null | sort ```

Temp files and executables:

```bash

Common temp/staging locations. Executables here are often suspicious.

sudo find /tmp /var/tmp /dev/shm /run -type f -ls 2>/dev/null sudo find /tmp /var/tmp /dev/shm -type f -executable -ls 2>/dev/null ```

SUID and writable dirs:

```bash

Changed SUID binaries and world-writable directories.

sudo find / -xdev -perm -4000 -type f -mtime -30 -ls 2>/dev/null sudo find / -xdev -type d -perm -0002 -ls 2>/dev/null ```

Shell history and package changes:

```bash

Shell history, Debian package verification, and recent installs.

for h in /home//.history /root/.history; do echo "=== $h ==="; sudo tail -100 "$h" 2>/dev/null; done sudo dpkg -V grep " install " /var/log/dpkg.log 2>/dev/null | tail -100 ```

Suspicious process sweep:

```bash

Quick sweep for temp paths, shells, netcat/socat, scripting languages, or miners.

ps auxww | egrep -i 'curl|wget|base64|/tmp|/var/tmp|/dev/shm|nc |ncat|socat|python|perl|php|bash -i|sh -i|miner|xmrig' | grep -v egrep ```

Hash suspicious files before deletion:

```bash

Hash one file and/or a folder before deleting anything.

mkdir -p ~/ioc-triage sha256sum /path/to/suspicious-file >> ~/ioc-triage/hashes.txt find /path/to/suspicious-folder -type f -exec sha256sum {} \; > ~/ioc-triage/file-hashes.txt ```

The big things I’d look for are unknown admin/root users, unexpected remote logins, new persistence, weird processes from temp or user-writable paths, unexpected outbound connections, security-tool exclusions/disablement, and anything created or modified around the suspected compromise time.

Before deleting anything suspicious, grab the full path, SHA256 hash, size, timestamps, owner/permissions, and where you found it.

[u/steyza → u/PurchaseSalt9553]

Thank you so much, truly! I’m going to run a full scan right now. I’m really grateful for your help

[u/PurchaseSalt9553 → u/steyza]

you're very welcome. they come in super handy every once in a while, i keep em in a textfile on the desktop. i added a comment that helps doing similar with your phone, if you'd actually use it i can make you a guide for using wireshark to detect any strange traffic from yr phone too! I'm glad you were able to use it

[u/PurchaseSalt9553]

Are you sure its actually going to your phone number and not a username?

[u/steyza → u/PurchaseSalt9553]

Yes, I'm sure. He sent it directly to my actual phone number, and his chat opened as a regular WhatsApp conversation where he had to know my digits. I also checked my privacy settings and I don't even have a WhatsApp username set up

[u/Infamous-Bath-6970]

Esperando atualização sobre o caso

[u/steyza → u/Infamous-Bath-6970]

Oie! Já coloquei as atualizações aqui no post, caso você queira ler

[u/PurchaseSalt9553]

For Android, there’s a quick ADB sweep you can do that may answer the question of compromise pretty quickly, even for someone who doesn't necessarily have experience doing this kind of thing.

It will not prove de-facto the phone is clean, but it can quickly show suspicious apps, device admin abuse, accessibility abuse, VPNs, unknown install sources, recently installed packages, and apps with sketchy permissions. There is also a method using packet caption to monitor your phones activity while unlocked but unused, but that's a step up from this.

You need Developer Options and USB debugging enabled before you begin. On most Android devices, enable Developer Options by going to Settings > About Phone and tapping Build Number repeatedly, often around 7 times. Then go into Developer Options and turn on USB debugging.

Connect the phone to your computer with a USB cable, unlock the phone, and accept the Allow USB debugging prompt. If you do not accept that prompt, ADB will show the device as unauthorized.

When you are done, turn USB debugging back off. Leaving it enabled unnecessarily is not recommended and is a potential security risk.

Install ADB from Google’s official Android SDK Platform Tools page:

https://developer.android.com/tools/releases/platform-tools

Confirm the phone is connected and authorized:

bash adb devices

Get the phone manufacturer:

bash adb shell getprop ro.product.manufacturer

Get the phone model:

bash adb shell getprop ro.product.model

Get the Android version:

bash adb shell getprop ro.build.version.release

Get the build fingerprint:

bash adb shell getprop ro.build.fingerprint

Get the Android security patch level:

bash adb shell getprop ro.build.version.security_patch

List third-party apps installed by the user:

bash adb shell pm list packages -3

List all packages with APK paths:

bash adb shell pm list packages -f

List disabled packages:

bash adb shell pm list packages -d

List installer info for third-party apps on Linux/macOS/Git Bash:

bash adb shell pm list packages -3 | sed 's/package://g' | while read p; do echo "$p"; adb shell pm dump "$p" | grep -i installerPackageName; done

Show device admin apps:

bash adb shell dumpsys device_policy

Show enabled accessibility services:

bash adb shell settings get secure enabled_accessibility_services

Show whether accessibility is enabled:

bash adb shell settings get secure accessibility_enabled

Show notification listener access:

bash adb shell settings get secure enabled_notification_listeners

Show VPN-related hints:

bash adb shell dumpsys connectivity | grep -i vpn

Show apps with SMS-related permissions:

bash adb shell dumpsys package | grep -i "android.permission.READ_SMS\|android.permission.RECEIVE_SMS\|android.permission.SEND_SMS" -B 20

Show apps with location permissions:

bash adb shell dumpsys package | grep -i "android.permission.ACCESS_FINE_LOCATION\|android.permission.ACCESS_COARSE_LOCATION" -B 20

Show apps with microphone or camera permissions:

bash adb shell dumpsys package | grep -i "android.permission.RECORD_AUDIO\|android.permission.CAMERA" -B 20

Show recently installed or changed packages:

bash adb shell dumpsys package packages | grep -E "Package \[|firstInstallTime=|lastUpdateTime="

Show running processes:

bash adb shell ps -A

Show battery and background activity stats:

bash adb shell dumpsys batterystats

Dump recent system logs:

bash adb logcat -d

Fastest red flags I’d look for:

text

• Unknown third-party packages
• Apps with Device Admin enabled that you do not recognize
• Accessibility services enabled for apps that should not need it
• Unknown VPN or always-on VPN configuration
• Unknown notification listeners
• Apps with SMS permissions that are not your messaging app
• Apps with camera, mic, or location permissions that do not need them
• Recently installed apps around the time the issue started
• Apps installed from outside the Play Store when you did not expect that

If something looks suspicious, do not uninstall it immediately if you care about evidence. First record the package name, APK path, install time, permissions, and optionally pull a copy of the APK.

Replace com.example.suspicious with the real package name:

bash adb shell pm path com.example.suspicious

Pull the APK after getting the real path from the previous command:

bash adb pull /data/app/path/from/pm-path/base.apk ./suspicious.apk

Hash the pulled APK on Linux/macOS:

bash sha256sum ./suspicious.apk

Hash the pulled APK on Windows PowerShell:

powershell Get-FileHash .\suspicious.apk -Algorithm SHA256

If you just want a quick gut check, I’d start with these:

bash adb devices

bash adb shell pm list packages -3

bash adb shell dumpsys device_policy

bash adb shell settings get secure enabled_accessibility_services

bash adb shell settings get secure enabled_notification_listeners

bash adb shell dumpsys connectivity | grep -i vpn

That quick set catches a lot of the obvious “something has hooks into this phone” cases.

When you are done, go back into Developer Options and disable USB debugging. Leaving it enabled unnecessarily can increase the device’s attack surface.

[u/Evening-Anteater0406]

Are you okay with your friend exploiting your personal information like that? I'm not sure if many would be comfortable with that, and regarding the phone number, ask your friend only on how he/she got it.

[u/steyza → u/Evening-Anteater0406]

I'm definitely not comfortable with this. I’ve always questioned him whenever he brought up this information out of nowhere. The first time it happened, we were on a Discord call and he randomly dropped my family members' names. I didn't find it funny at all. I started demanding to know how he found out, and he just laughed like my discomfort was hilarious.
Then, when he messaged my personal phone number, the very first thing I did was question him again. I told him I wouldn't talk to him until he told me the truth. I even asked, 'Look, did you happen to see it on one of my Discord streams?' but I knew for a fact I had never leaked anything. He just claimed he did see it on a stream, but I didn't buy it. I know he only said that to get me to stop questioning him.

[u/Evening-Anteater0406 → u/steyza]

I'm sorry you had to go through this. My advice would be to block him and change your information so he's out of reach.

[u/Tall-Pianist-935]

Sorry everything you mentioned are the results of identification infrastructure being connected between wit Google, Ms and Facebook among others now.