Choose a response based on what happened
Before changing passwords on the same device, follow the order appropriate to the incident.
I ran a suspicious command
2After pasting a command into PowerShell, CMD, or a terminal
I opened a suspicious file
3After opening an exe, zip, scr, msi, or similar file
I entered my password
4After entering credentials on a possibly fake page
My account is sending DMs
5When your account is spreading messages without you
I received a login alert
An alert from an unfamiliar device or location