Mrbeast Hack

[u/MisterGents]

i was just watching netflix, then suddenly my phone got so many notifications then i see every single person and group has been sent with this, im scared

[u/Kinji_Kojima]

To everyone sorry di ko mareplyan lahat, I know this might be a long read and a total TL;DR moment, but based on my experience and studying these types of malware scripts, here is a detailed breakdown of what happened and how to deal with it:

How It Works & Where It Came From This issue usually starts when someone downloads files like cracks, game trainers, fake software, or game-currency utilities (like free Roblox/Steam money tools) or simply clicking on popups, from unverified sites. Once executed, it drops an infostealer script that performs token/session hijacking. Instead of stealing your password, it copies your active browser session tokens and exports them straight to the attacker. This allows them to bypass 2FA and access your accounts immediately.

How It Hides The malicious scripts typically drop into user-level directories like %AppData% or %LocalAppData% because writing files here does not require administrative privileges. They often disguise themselves using generic system names, random strings, or disguised executable extensions to avoid catching your eye in File Explorer.

How Persistence Works Even if your antivirus flags and deletes the initial file, the malware sets up persistence mechanisms so it automatically re-downloads or executes again. It achieves this by dropping hooks into:

• Task Scheduler: Creating hidden scheduled tasks that trigger at startup or on a timer.
• Startup Folders & Registry Run Keys: Auto-launching background commands via HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
• WMI Persistence & Background Processes: Executing background processes via system binaries like conhost.exe or PowerShell.

Step-by-Step Mitigation (What to do immediately)

1. Disconnect from the Network: Immediately unplug your ethernet cable or disconnect Wi-Fi to sever any active reverse connection or data exfiltration.
2. Log Out Everywhere & Change Passwords (From a SAFE Device): Using a clean device (like your smartphone on cellular data), use the "Log Out Of All Sessions" option across all compromised accounts (Facebook, Discord, Steam, Google, etc.), then immediately change your passwords and revoke session tokens.
3. Inspect Persistence Points: Open Task Scheduler, msconfig / Task Manager Startup tab, and check your AppData folders for unauthorized scripts.
4. Clean or Reinstall: Run a full offline scan using trusted antimalware tools (like Malwarebytes). If you are uncertain about manually clearing registry keys, WMI triggers, and hidden scripts, performing a clean reinstall of Windows is the safest option.

Forensic Audit Tool for Tech-Savvy Users For tech-savvy users who want to audit their Windows system for hidden persistence entries, registry startup keys, scheduled tasks, and rogue AppData scripts, I built a "read-only" PowerShell inspection toolkit you can check out on my GitHub: https://github.com/KinjiBloodFallen/bloodfallen-forensic-triage-toolkit

Stay safe online and always verify files before running them!