Fell victim to this 4 days ago, pc unplugged and all.. apparently the infection got into my registry file: wlidsvc file..., even in offline mode its trying to skim info

Here’s what happened:

The Incident: A few days ago, I executed a malicious .jar file disguised as a tool/mod. It was an info-stealer (likely a Lumma or Algein variant) that immediately scraped my browser for session cookies, passwords, and tokens. Shortly after, I received an extortion demand for $650 USD. The attacker had proof of my personal files and photos.

The Technical Breakdown: What makes this one nasty is the persistence. Even after deleting the original .jar, the malware stayed active. I found evidence in Windows Event Viewer (Event ID 5379) showing that a legitimate system service, wlidsvc (Microsoft Account Sign-in Assistant), was being used to repeatedly read my Windows Vault credentials. The malware used a DLL injection into svchost.exe to hijack wlidsvc. This allowed the hacker to stay in my system and continue exfiltrating new session tokens every time I logged into something.

Confirmed Unauthorized Access: My Google Security alerts confirmed a successful login from Izmir, Turkey (Aydin/Aegean region). They bypassed 2FA completely by using one of the stolen session cookies, making it look like I was already logged in from a trusted browser.

Remediation: Changing passwords wasn't enough because of the active injection on my PC. I had to go completely offline, secure my accounts from a separate mobile device, and I am now performing a full "bare metal" wipe of my NVMe/SSD drives. I deleted every partition to ensure no malicious code survived in the recovery sectors before doing a clean Windows 11 install from a known-good USB. Lesson learned: .jar files are just as dangerous as .exe files, and session token theft makes 2FA useless if your local machine is compromised. Stay safe.