When the Breach Was Your Own Computer

By Glenn Lyvers · Updated September 20, 2026 · 4 min read

You have been through the site twice. Everything is patched, nothing was outdated, and the access logs show no exploitation attempt that worked — just a normal login, from an address you do not recognize, with correct credentials. At that point the uncomfortable question is whether the compromise happened on your website at all, or on the computer you administer it from.

What stealer malware does

It is a category of malware built for one job: harvest credentials and leave. It reads saved passwords from browsers, session cookies, FTP client configurations, cryptocurrency wallets and password manager data where it can reach it, packages all of it up, sends it out, and often deletes itself. The whole process takes seconds and leaves little sign.

The stolen data then gets sold in bulk. Somebody buys a batch, runs the credentials against the relevant services, and uses whatever works. That is why the attack on your site can come weeks after the infection on your machine, and why it looks so unremarkable in your logs — because from the server's point of view, nothing unusual happened.

The signs pointing this way

The pattern is a compromise with no technical entry point. Everything was up to date. No suspicious requests preceded the incident. The logs show a successful login with valid credentials rather than a string of failed attempts. And the attacker went straight to something useful rather than probing around, which is what happens when someone already knows the password.

Another strong indicator is breadth: several unrelated services compromised around the same time — your hosting, your email, a social account, a registrar — with no connection between them except that you have logged into all of them from the same computer.

How machines get infected

The common routes are ordinary rather than exotic. Cracked or pirated software, which is the single largest source. A file downloaded from a search result that looked like a legitimate installer. A fake browser update prompt, which is the visitor-facing side of the campaign covered in my guide on SocGholish. A ClickFix prompt that persuaded someone to paste a command into their own terminal. A malicious browser extension.

None of it requires carelessness in any dramatic sense. These campaigns are well made, they imitate legitimate software convincingly, and they target ordinary people doing ordinary things.

Checking your machine

Run a full scan with a reputable, updated security product, and ideally with a second one as well since detection varies. Check what is set to run at startup, look at installed browser extensions and remove anything you did not deliberately add, and review recently installed applications.

Be aware that a clean scan is reassuring rather than conclusive, particularly for malware that ran once and removed itself. If the evidence pattern points strongly at credential theft, act on that assumption even if the scan finds nothing. For a machine used to administer business-critical systems, a full reinstall is the only genuinely certain answer.

The cleanup order

Clean the computer first. Rotating credentials from an infected machine simply hands the new ones over as you type them, which is a genuinely common way people spend a whole day achieving nothing.

Once the machine is clean, or from a different device you trust, rotate everything — the full list is in my guide on rotating credentials after a hack. Do not forget session cookies: change WordPress salts, and sign out of all sessions at every service that offers it, because a stolen cookie works without a password. Then clean the website itself, since whoever logged in had full administrator access.

Reducing the risk

Two-factor authentication is the single most valuable measure, because it makes a stolen password insufficient on its own. Put it on hosting, registrar, email and WordPress at minimum. Use a password manager with unique passwords rather than browser-saved credentials, which are among the first things stealers read.

Beyond that: do not install pirated software, be sceptical of installers from search results, keep browser extensions to a minimum, and consider keeping administration of important systems on a machine that is not also used for general browsing. If your site was compromised through stolen credentials and you want it properly cleaned while you deal with the machine, that is what my malware removal service is for.

Common questions

How would I know the breach came from my computer?

The pattern is a compromise with no technical entry point — everything patched, no exploitation attempts in the logs, and a successful login with valid credentials from an unfamiliar address. If several unrelated services were also compromised around the same time, that points strongly at a device you use for all of them.

My antivirus found nothing. Does that clear my machine?

Not definitively. Much stealer malware runs once, harvests what it can and deletes itself, leaving nothing for a scanner to find afterwards. A clean scan is encouraging, but if the evidence points at credential theft you should act on that regardless of what the scan says.

Should I change my passwords right away?

Not from the suspect machine. If it is still infected, you are handing over the new credentials as you create them. Clean the machine first, or do the rotation from a different device you trust, and only then work through every account.

Why did the attack happen weeks after I was infected?

Because stolen credentials are sold in bulk. The malware harvests and leaves; somebody buys a batch later and works through it. The delay between infection and exploitation is normal and is part of why the connection is so easy to miss.

What stops this happening again?

Two-factor authentication above everything else, since it makes a stolen password insufficient on its own. Then a password manager with unique passwords rather than browser-saved ones, no pirated software, minimal browser extensions, and ideally administering critical systems from a machine that is not used for general browsing.