security.riyo.me
DO THIS NOW

After running a suspicious command

Do not enter new credentials on a device that may still be compromised.

Disconnect the device now

Disconnect network access first. On an organization-managed device, contact the administrator and follow its incident-response process.

  1. 1
    Disconnect the network

    Disable Wi-Fi, Ethernet, and VPN connectivity to stop additional downloads or exfiltration.

  2. 2
    Use another trusted device

    Protect important accounts from a phone or computer you trust.

  3. 3
    Change passwords and log out all sessions

    Prioritize email, Discord, social accounts, and every reused password.

  4. 4
    Review 2FA and connected apps

    Check authenticators, passkeys, OAuth apps, bots, and backup codes for unexpected changes.

  5. 5
    Run a full device scan

    Update security definitions and run a full scan. Consider resetting the device if the cause cannot be removed confidently.

  6. 6
    Warn your contacts

    Tell people not to open links, QR codes, or files sent from your compromised account.