How a pirated activator took over a client's accounts

This week I helped a client whose Instagram and Discord accounts were sending DMs and posting stories about crypto on their own. Not personal accounts, but the company’s official ones.

The interesting part isn’t the hack itself. It’s how it got in: not through the network, and not through a weak password.

I’m sharing the lessons I wrote down, plus the technical side of how it works, so we can all be more aware.

How it got in

The source was one computer in that office that had just installed a pirated activator for Office and Windows.

The activator asked the user to disable Windows Defender, turn off the firewall, and exclude a folder from scanning.

What came in through the door they’d opened wasn’t just the activator. Another program slipped in along with it.

This tag-along program is called an info-stealer, a category of malware with just one job: find login data and send it to the attacker. What it usually goes after:

  • passwords saved in the browser
  • session cookies (this one’s important, more on it below)
  • Discord token files
  • crypto wallets, if there are any

Cookies, tokens and a shared folder

The cookie part is what often surprises people.

If you’re logged into Instagram in Chrome and you close the tab, Instagram doesn’t make you log in again when you open it the next day, right? That’s because of a cookie, a small file that marks “this browser is already logged in.” That cookie is stored in Chrome’s folder on your laptop.

The info-stealer just copies that cookie file and sends it to the attacker. The attacker pastes it into their own browser and they’re straight into your account. No password, no OTP, no notification about a login from a new device.

Because from Instagram’s side, “your browser” and “the attacker’s browser” look exactly the same. The cookies are identical.

Discord is different again. Discord stores a login token in a local file on your laptop. The info-stealer reads that file, extracts the token and sends it to the attacker.

Once they have the token, the attacker can use a bot to broadcast automatically. That’s why hacked accounts usually send mass DMs. They aren’t typed out by hand, they’re automated.

It spread between PCs because the office LAN allowed file sharing, and info-stealers can also copy themselves into shared folders. Only one PC installed the pirated software. But two other PCs got infected too, because they picked up copies from the shared folder.

The LAN isn’t the problem. The LAN turns one PC’s problem into the whole office’s problem.

What I noted down

These are notes for myself, and maybe they’re relevant to you too.

1. Stop using pirated software. It looks like a saving up front, but what you pay later costs more: your accounts, your customers’ trust, recovery time. Microsoft 365 Business is around Rp 100,000 a month these days.

2. Don’t install apps that tell you to turn off your antivirus first. No legitimate app will ever ask for that. If an installer asks you to disable Defender, turn off the firewall or exclude a folder, that’s the clearest red flag there is. Even if it seems to be just “to avoid false positives”, don’t go ahead.

3. SMS 2FA alone won’t stop this attack. What gets stolen is cookies and tokens, not passwords, so the attacker has already gotten past the login step. What helps: log out of work devices regularly, and don’t leave cookies sitting in office browsers indefinitely.

For anyone who manages a team or runs a small office: the homework here isn’t for IT. It’s about your people’s awareness. One employee installs something carelessly, and the whole office gets hit.

It’s worth talking through with your team, patiently:

  • why software has to be official
  • why Defender must never be turned off
  • why office computers aren’t the place to try out random apps

This story also reminded me of another client I helped a while back.

A former employee, who had already resigned, installed pirated software on a personal laptop. But that laptop was still signed in to the old company email, and some of the software’s activity was still linked to the company’s domain.

The one who got the legal notice wasn’t the employee. It was the former employer. The claim was for almost Rp 1 billion.

The lesson I took from that case: when an employee resigns, don’t just revoke their email access on the server. Also make sure their email account has been logged out of any personal devices they used for work.

Because some software license violations are tracked by which email is detected as active, not by the name of the laptop’s owner.

Most cases like this don’t happen because the attacker is skilled, or because whoever sends the legal notices is busy hunting for victims. They happen because one small layer got skipped, one time: pirated software that seemed harmless, an account someone forgot to log out of, an antivirus switched off so things would run “smoothly.”

An office computer isn’t a personal computer. Carry that mindset and half the problems are solved before they happen.