Privacy Tools Guide

Immediately disconnect from the network, force-quit your browser, and do not enter any credentials or interact with the page that loaded. Once isolated, check your downloads folder for unexpected files, scan for unusual processes, and rotate passwords for any accounts where you use the same credentials. Acting within the first 60 seconds prevents ongoing communication with attacker-controlled servers and stops potential data exfiltration before it starts.

Immediate Actions (First 60 Seconds)

The moment you realize you clicked something questionable, stop interacting with the page. Do not enter any credentials, do not download files, and do not click anything else on the page that loaded.

Disconnect from the Network

If the page loaded and you suspect it might be malicious, disconnect your device from the network immediately. This prevents any ongoing communication with attacker-controlled servers and stops potential data exfiltration.

On macOS, you can quickly toggle AirPort off:

# Disconnect WiFi on macOS
networksetup -setairportpower en0 off

# Or use this one-liner
sudo networksetup -setairportpower en0 off

On Linux:

# Bring down the network interface
sudo ip link set wlan0 down
# Or for ethernet
sudo ip link set eth0 down

If you’re using a wired connection, simply unplug the ethernet cable. For developers working in containers or VMs, consider shutting down network services or pausing the environment.

Close the Browser

Force-quit the browser to ensure no additional scripts execute. On macOS:

# Force quit all browser processes
pkill -9 -f "Chrome|Firefox|Safari|Arc|Brave"

On Linux:

pkill -9 -f "firefox|chrome|brave"

Assessment Phase (Minutes 1-30)

Once you’ve isolated the situation, determine what happened. This requires methodical investigation.

Analyze the URL

If you can recall or copied the URL before closing the browser, analyze it. Even if you didn’t, check your browser history—it’s crucial evidence.

# On macOS Chrome, export recent history to analyze
sqlite3 ~/Library/Application\ Support/Google/Chrome/Default/History "SELECT url, title, visit_count FROM urls WHERE url LIKE '%suspicious%' OR title LIKE '%suspicious%' ORDER BY last_visit_time DESC LIMIT 20;"

For Firefox:

sqlite3 ~/.mozilla/firefox/*.default/places.sqlite "SELECT p.url, p.title, h.visit_date FROM places p JOIN historyvisits h ON p.id = h.place_id WHERE p.url LIKE '%suspicious%' LIMIT 20;"

Look for these red flags in URLs:

Check for Downloads

Examine your downloads directory for any files that may have been automatically downloaded:

# macOS
ls -la ~/Downloads/

# Linux
ls -la ~/Downloads/

If you find unexpected files, do not open them. Use file command to identify their type:

file ~/Downloads/suspicious_file

Review Browser Extensions

Malicious pages can attempt to install or activate malicious extensions. Check your browser extensions:

# Chrome extensions directory
ls -la ~/Library/Application\ Support/Google/Chrome/Default/Extensions/

# Firefox addons
ls -la ~/.mozilla/firefox/*.default/extensions/

Remove any extensions you don’t recognize or that were installed recently without your knowledge.

Detection and Scanning

Now that you’ve contained the immediate threat, check if your system was compromised.

Check for Unusual Processes

Look for processes consuming high CPU or network traffic:

# Check for processes using network
lsof -i

# Look for suspicious outbound connections
netstat -antp | grep ESTABLISHED

# On macOS with ndp (if installed)
ndp -anp

Run a Malware Scan

For developers, consider using dedicated tools beyond standard antivirus:

# Install and run ClamAV (cross-platform)
brew install clamav
freshclam
clamscan -r ~/

# For macOS, also check for known malware signatures
brew install malwarebytes

Check for New Startup Items

Malicious scripts often add themselves to startup:

# macOS launch agents
ls -la ~/Library/LaunchAgents/
ls -la /Library/LaunchAgents/

# macOS launch daemons
ls -la /Library/LaunchDaemons/

# Linux systemd services
systemctl list-unit-files | grep enabled

Review Bash History

Attackers may have run commands through your terminal if a malicious page managed to inject code:

# Review recent commands
history | tail -50

# Or check the history file directly
tail -50 ~/.bash_history

Look for commands you didn’t type, especially those involving:

Credential and Account Protection

If you entered any information on the suspicious page, act immediately.

Rotate Compromised Credentials

If you entered a password on the malicious page, change it immediately—not just on the affected service, but on any account where you use that password. Use a password manager to generate new, unique passwords.

# If you use 1Password CLI to manage credentials
op item get "Account Name" --vault "Personal"

# Generate a new password
op create item password --generate

Enable Two-Factor Authentication

Enable 2FA on all critical accounts if not already active. For developer accounts (GitHub, AWS, GCP, Azure), use hardware security keys when possible:

# Check GitHub 2FA status via CLI (requires authentication)
gh auth status

Revoke Active Sessions

Review and revoke active sessions for important services. Many services offer session management in their security settings:

Browser and System Cleanup

After the incident, clean your browser environment thoroughly.

Clear All Cookies and Site Data

# Clear Chrome data (macOS)
rm -rf ~/Library/Application\ Support/Google/Chrome/Default/Cookies
rm -rf ~/Library/Application\ Support/Google/Chrome/Default/History*
rm -rf ~/Library/Application\ Support/Google/Chrome/Default/Local\ Storage/

Reset Browser Settings

Restore browser settings to defaults to remove any injected scripts or modified configurations. In Chrome: Settings → Reset and cleanup → Restore settings to their original defaults.

Update All Software

Ensure your operating system, browser, and all applications are fully updated:

# macOS
softwareupdate -ia

# Linux (Debian/Ubuntu)
sudo apt update && sudo apt upgrade -y

# Update browser
# Chrome: Visit chrome://settings/help
# Firefox: Visit about:support

Prevention for the Future

After handling this incident, implement these practices to reduce future risk:

Use a Dedicated Browser Profile

Create a separate browser profile for sensitive activities:

# Chrome - create new profile
google-chrome --profile-directory="Profile 2"

Implement Network Segmentation

For developers, consider using separate networks or VMs for browsing untrusted content:

# Quick VM isolation example using VirtualBox CLI
VBoxManage startvm "IsolatedVM" --type headless

Set Up Browser Extensions for Protection

Install these developer-focused security extensions:

When to Escalate

Some situations require professional help:

Contact relevant authorities if necessary, such as the FBI’s Internet Crime Complaint Center (IC3) or your local equivalent.

Built by theluckystrike — More at zovo.one