How to Know if Your Computer Is Hacked: Real Signs vs. False Alarms

How do I know if my computer is hacked?

Look for things that only happen when someone else is in control. A remote-access app you didn’t install. Inbox rules you didn’t create. MFA prompts on your phone when you weren’t signing in. Password-reset emails you didn’t request. Antivirus that’s suddenly off. Colleagues or clients asking about an email you never sent. Any one of those is worth a call to IT today.

Here’s each one in plain terms:

• A remote-access program you don’t recognize. AnyDesk, ScreenConnect, and similar tools are legitimate, and IT teams use them every day. That’s why attackers like them too. CISA’s January 2023 advisory, Protecting Against Malicious Use of Remote Monitoring and Management Software, describes criminals tricking people into installing them and then using that access as a backdoor. If one shows up and your IT provider didn’t put it there, treat it as an intruder.
• New inbox rules or forwarding. Microsoft’s guide to responding to a compromised email account lists rules that forward mail to unknown addresses, or quietly move messages into folders like RSS Subscriptions or Junk, as common symptoms. Attackers do this so the replies to their fake emails never reach you.
• MFA prompts you didn’t trigger. If your phone asks you to approve a sign-in and you weren’t signing in, someone has your password. CISA calls the repeated version “MFA fatigue” or “push bombing” in its number matching fact sheet. The attacker sends prompt after prompt until you tap approve by accident or just to make it stop. Deny it and call IT.
• Password-reset or “your password was changed” emails you didn’t ask for. The FTC lists this, along with sign-in alerts from devices or places you don’t recognize, in its hacked email guidance. One caveat: a stray signup or verification code is often just someone typing your address into a form. We walked through how to tell the two apart in our report on verification codes you didn’t request.
• Antivirus or Windows Security turned off. You didn’t turn it off, and now it’s off. Microsoft’s tamper protection overview says it plainly: “During cyberattacks, attackers often try to disable security features.” Task Manager suddenly being disabled is on the FTC’s list too.
• Email going out that you didn’t write. Messages in your Sent folder you don’t remember sending, or a client asking why you emailed them a strange link or new payment instructions. That’s the setup for business email compromise, and it’s urgent.

What usually isn't hacking?

A slow computer and a scary browser pop-up are the two things that bring most people to this page, and usually neither one means you’ve been hacked. Slowness is most often a full disk, a pending update, or too much running at startup. A pop-up with a phone number is a scam web page, not a message from your computer.

To be fair to the FTC, its malware guide does list slowing down, freezing, and crashing as possible signs. They are. They’re also signs of a dozen boring problems. In one of our cases, a “my computer is slow” ticket turned out to be 2 GB free on a 256 GB drive. Slowness plus one of the strong signs above is worth a call. Slowness alone usually isn’t.

The pop-up is the bigger trap. It takes over the browser, maybe beeps, and tells you to call “Microsoft support” right away. The FTC’s tech support scam page is clear: “Real security pop-up warnings and messages will never ask you to call a phone number.” How many real virus alerts ask you to call a number? None. The person on the other end wants you to install a remote-access tool so they can “fix” the problem, which is exactly how a fake alert becomes a real compromise. Close the browser (Task Manager or a restart works if it won’t close) and don’t call.

Changed homepages, new toolbars, and search results going to strange sites are a middle case. That’s usually a browser hijacker: annoying, worth removing, rarely a hands-on attacker. See our browser hijacker removal guide and the OneStart case where 30 machines had the same one.

What should I do right now if my work computer was hacked?

Contain it, don’t destroy evidence, and get IT involved fast. In order:

1. Disconnect it from the network. Unplug the network cable and turn off Wi-Fi. CISA’s ransomware response checklist says to isolate affected systems immediately.
2. Leave it powered on. CISA only recommends powering down if you can’t disconnect, because shutting off loses evidence in memory. Don’t restart it over and over either.
3. Don’t wipe it, reinstall Windows, or run cleanup tools you found online. That erases what IT needs to figure out how they got in and what they touched. Removal is IT’s job on a work machine.
4. Call IT, by phone. Don’t email from the affected account. Tell them what you saw and when. If you already let someone connect remotely, or approved an MFA prompt you didn’t start, say so first.
5. Change your passwords from a different, clean device. Start with email, then anything that touches money. Changing them on the infected computer can hand the new password straight to the attacker. Microsoft’s guidance also says to sign the account out everywhere and check MFA methods; your IT team should do both.
6. Don’t pay anyone and don’t move money. If a payment or wire is involved, call your bank now, and verify any changed payment instructions by phone first. Here’s how to verify wire instructions.
7. Report it. IT will tell you whether to file with the FBI’s IC3 or CISA. If your firm is regulated, notice deadlines may apply. That’s what an incident response plan is for.

If you saw something specific, which guide should you read?

• Clicked “I’m not a robot,” then got told to paste something into Run or a terminal: ClickFix fake CAPTCHA malware.
• Your browser said it needed an update, and you downloaded it from the page: SocGholish fake browser updates.
• You installed software from a search ad and it wasn’t what you expected: malvertising and fake software downloads.
• Saved passwords or session logins were used somewhere else: infostealer malware.
• You signed in through an email “document to review” link: fake DocuSign emails.

How do you stop it from happening again?

Most of these signs are things the right tools catch before you do. Endpoint detection and response flags a new remote-access tool or a disabled antivirus and can isolate the machine on its own. We explain the difference in EDR vs antivirus. Phishing-resistant MFA stops push bombing because there’s no prompt to approve by accident; see phishing-resistant MFA. Monitoring for new inbox rules and odd sign-ins catches the email side. And a tested 3-2-1 backup means a bad day doesn’t turn into lost data.

Key takeaways

What this looks like when we do it

On our managed IT and security service, EDR runs on every managed endpoint with 24/7 monitoring behind it. On the Microsoft 365 side, we enforce MFA and audit sign-ins and forwarding rules, which is where the email signs above show up first. When a client calls with “I think I got hacked,” critical issues get a response in under 15 minutes. We’d rather hear about a false alarm than miss a real one, so call even if you’re not sure.

If you’re not sure what’s running on your office computers right now, our managed IT security page covers the baseline, or book a call and we’ll go through it with you.