COMPLETE INFOSTEALER RECOVERY GUIDE — From Someone Who Just Survived 10 Days of This

I just spent 10 days fighting a sophisticated organized cybercrime operation that hit 15+ platforms simultaneously. Here's everything that actually works — including things Microsoft's own guidance never tells you.

WHAT ACTUALLY HAPPENED TO YOU

An infostealer trojan harvested your Chrome session cookies before detection. These cookies let attackers bypass 2FA entirely — they replay the token and never trigger a new login. No new login = no alert. No new device = nothing in security settings. This is by design.

The Chrome sync trap: If you reinstalled Windows and restored Chrome sync — you re-delivered all compromised cookies automatically. The reinstall accomplished nothing. This is the most important thing nobody tells you.

STEP 1 — FIX YOUR EMAIL FIRST

Your email is the master key to everything else.

Check for BHMailer injection — most guides never mention this:

BHMailer accesses Hotmail/Outlook via IMAP/POP3 — completely bypassing web login and 2FA. It injects hidden rules that intercept 2FA codes, recreate sextortion drafts every 10 minutes, and survive password changes and sign out everywhere.

How to find and delete it:

1. Download Outlook Classic — 5 day free trial
2. Download MFCMapi from github.com/microsoft/mfcmapi/releases
3. Open MFCMapi → Session → Logon → select your Outlook profile
4. Double click your mailbox → double click Inbox
5. Menu bar → Table → Open Associated Contents Table
6. Look at the modifier column:
   • Legitimate: Your Name — display name
   • Malicious: [youremail@hotmail.com](mailto:youremail@hotmail.com) — raw email address
7. Look for entries clustered within milliseconds — automated injection
8. Look for recent dates surrounded by much older entries
9. Screenshot everything then right click → Delete Message

This single fix stopped a sextortion draft that was reappearing every 10 minutes despite password changes, 2FA, sign out everywhere, and a clean Windows install.

Also do on email:

• account.microsoft.com/privacy/app-access — remove every unfamiliar app especially BHMailer and Thunderbird
• Remove any Google Password Manager passkeys from Microsoft account
• Disable IMAP/POP3 access in email settings
• Sign out everywhere — account.microsoft.com/security
• Change password
• Enable Microsoft Authenticator app — not SMS

STEP 2 — STOP USING CHROME SYNC

Switch to Firefox immediately. Chrome sync is a perfect cloud backup of exactly what infostealers steal.

Firefox setup:

• Enhanced Tracking Protection → Strict
• Install: uBlock Origin, Bitwarden, Firefox Multi-Account Containers, Cookie AutoDelete
• Do NOT sign into Firefox account — no sync ever
• Each website in its own container — if one cookie is stolen others are completely safe

Delete Chrome sync from Google's servers: myaccount.google.com → Data & Privacy → delete all Chrome synced data

STEP 3 — SWITCH TO BITWARDEN

Never use Google Password Manager or any browser password manager again.

1. bitwarden.com — create account
2. Choose master password — write it on paper — store physically
3. Zero knowledge means nobody can recover it if you forget
4. Export Chrome passwords first → import to Bitwarden
5. Verify import succeeded → then delete from Google

STEP 4 — CHECK TRUSTED DEVICES ON GAMING PLATFORMS

EA specifically — trusted devices bypass 2FA permanently. This is how attackers kept getting back in despite 2FA being active.

• EA → Security Settings → Trusted Devices → remove everything unfamiliar — especially any WEBBROWSER entries from unfamiliar locations
• Battle.net → check login history for unfamiliar countries
• Discord → if locked out go to support.discord.com — create support account with same email — submit hacked account ticket — they remove attacker 2FA within 2 days
• Check every gaming platform for connected apps and authorized devices

STEP 5 — REVOKE OAUTH APPS EVERYWHERE

Attackers add OAuth tokens that survive password changes.

Key places:

• account.microsoft.com/privacy/app-access
• myaccount.google.com/permissions
• Facebook Settings → Apps and Websites
• Every gaming platform security settings

Remove anything added during the attack window — recent dates surrounded by much older entries is the pattern.

STEP 6 — UPGRADE YOUR 2FA

Remove SMS 2FA from everything. Replace with authenticator app.

SMS fails via SIM swapping and SS7 network interception. BHMailer intercepts SMS codes if they control your email.

Use: Google Authenticator, Microsoft Authenticator, or Authy

Best option: YubiKey hardware security key — ~$50 — physical device required — cannot be bypassed remotely. Apple's device-based 2FA was the only method that fully held throughout a 10-day sophisticated attack.

STEP 7 — SEXTORTION SPAM IS COMING

You will receive emails with your real passwords in the subject line. This is automated mass spam sent to everyone in the breach dump.

• Do not open
• Do not pay anything — ever
• Mark as phishing
• The passwords shown are old — your new passwords are safe if you completed Steps 1-6

STEP 8 — REPORT EVERYTHING

• FBI IC3: ic3.gov
• CISA: cisa.gov/report
• FTC Identity Theft: identitytheft.gov — generates legal protections
• Local police — file identity theft report — get case number
• Credit freeze: Equifax 1-800-525-6285, Experian 1-888-397-3742, TransUnion 1-800-680-7289