Steps to Take After Entering a Password on a Phishing Mirror

Change the password on the email account tied to that login first. That email controls password resets for everything else. The moment you entered credentials on a fake darknet site, that inbox became the single point of failure that can cascade into a full takeover across every service you use. Every minute you delay, whoever harvested the data can request resets on financial accounts, linked crypto services, and recovery addresses before you realise the scope of the breach.

If you reused that password on your email, your bank, your exchange, or your messaging apps, assume the pair is already being tested against common services. Most phishing kits automate this within the first hour of harvest. Treat every account that shared that password as already probed, even if you have not seen an alert yet.

Continue with the section overview or a closely related question:

• After exposure
• What should I do after clicking a suspicious link?
• What if I downloaded a suspicious file?

Log into your email from a clean device and change its password immediately. Do not use the same machine you used when you entered the credentials on the fake mirror. If an info-stealer or remote access trojan rode along with the attack, that device is compromised and the new password will be captured before you finish typing.

Enable two-factor authentication if it is not already active. But understand the bypass risk. Session token theft and SIM swap both defeat SMS-based codes. Use an authenticator app or a hardware security key. Check for inbox filters or forwarding rules you did not create. Kit operators routinely set up rules that hide password-reset emails from you while forwarding them to a burner address. Delete every rule you did not make yourself.

Revoke Active Session Tokens Before Changing Anything Else

A stolen session token remains valid until the provider expires it or you explicitly revoke it. Most email services let you view and terminate all active sessions from the security settings page. Do this before changing the password. A password change alone does not always invalidate an existing token. The intruder can remain logged in and watching your inbox for hours or days after you think you have locked them out.

Detection latency on a phishing mirror averages two to four days before a domain is blocklisted or taken down. Your credentials may sit in a log file for 48 to 96 hours before the infrastructure is disrupted. Act within the first hour of the mistake and you have a real chance of locking the intruder out before the data is used. After four hours, assume the credentials have been tested against every major service.

After securing the email, change passwords on financial and recovery accounts next. Banks, payment processors, cryptocurrency exchanges, any account that stores a wallet or linked payment method. These are the ones where a takeover causes immediate monetary loss. Use a unique password for each. A password manager generates and stores these without relying on your memory. That is the only reliable way to break the reuse pattern the intruder is counting on.

If the fake page captured a second factor at the same time, such as a one-time code you typed in, that session is already fully authenticated from the intruder's perspective. Change the two-factor configuration on every impacted service. Re-enrol your authenticator app or register a new hardware key. Assume the intruder has an active authenticated session until you force it closed. Many services offer a "log out of all other sessions" option. Use it.

Check for Malware Persistence Before Trusting the Device Again

The phishing mirror may have delivered a malware loader that installed an info-stealer or clipboard hijacker alongside harvesting your credentials. Malware persistence mechanisms often survive a restart by hiding in scheduled tasks, registry keys, or launch agents. Run a full scan with a reputable anti-malware tool. Do not stop there. Check for unexplained processes in Task Manager or Activity Monitor. Look for browser extensions you did not install. An info-stealer often presents as a legitimate-looking browser helper or system utility.

If you find anything suspicious, reset the device to a clean state before logging into any recovered account. A factory reset or a clean operating system reinstall is the only way to be certain a remote access trojan is gone. Back up only documents, never applications or system settings, before wiping the device. Malware can embed itself in application preference files and reinstall on restore.

One phished password is rarely the whole story. Credential stuffing is the next move: automated scripts that feed your username and password pair into dozens of other services to see which ones accept it. Containment means changing every password that even partially resembles the compromised one. A common pattern, like "summer2026" on one site and "Summer2026!" on another, is trivially cracked by a stuffing script that expands the base string with common mutations.

Prioritise services that hold payment methods, then services that could be used to impersonate you, then everything else. Messaging accounts, social media profiles, and forum identities are impersonation vectors. Someone who controls your messaging account can contact your contacts, request money, or distribute phishing links from a trusted source. The impersonator account will look exactly like you to everyone in your network.

If a SIM Swap Is Underway, Respond in Minutes

A sudden loss of mobile service combined with unexpected password-reset notifications is the signature of a SIM swap attack. The intruder has convinced your mobile carrier to port your number to a new SIM in their possession. They are now receiving your SMS-based two-factor codes and using them to reset passwords on every account they can link to that number. Call your carrier immediately. Use a phone on a different line or a VoIP service if your own number is dead. Ask the carrier to suspend the port and lock your account with a verbal passcode or a physical store visit requirement.

After regaining control of the number, move every service away from SMS-based two-factor authentication. The SIM swap worked once, and the intruder may have collected enough personal information from your compromised accounts to attempt it again. Switch to an authenticator app that is not tied to a phone number. Treat SMS codes as a convenience, not a security control.

Session token theft is the attack most victims miss because it leaves no obvious trace. The intruder did not change your password or trigger a login alert. They simply took the session cookie that your browser sent to the fake mirror and imported it into their own browser. From that moment, they were you, logged into the real service, with no further authentication required. The session token lifespan on many services is measured in days, not hours, because legitimate users find frequent re-login annoying.

Prevention after the fact means revoking every session token on every service where you were logged in at the time of the incident. Do not limit this to the service whose login page was cloned. The info-stealer or token-capture script may have scooped up tokens for every service you had open in another tab. Browser session tokens are often stored in a single cookie jar. A phishing kit that captures one can often capture them all. Log out of every service from every device, then log back in on a clean machine with new passwords.

Monitor for Evidence of Token Reuse

Check the login history or account activity page on each major service. Look for logins from unfamiliar locations, devices, or IP addresses. A session token theft incident often shows a login from a geographic region that does not match your own, or from a device type you do not own. Screenshot every suspicious entry before it scrolls off the activity log. Evidence volatility on these logs is high because some services only retain the last ten or twenty entries.

If you see activity you did not perform, note the exact timestamp, IP, and device type and include that in any report you file. This data helps investigators correlate your incident with others and may link the intruder to a known phishing kit or credential harvesting campaign. Public report granularity from agencies like IC3 and Action Fraud improves when victims submit structured data rather than general complaints.

Credential stuffing is an automated numbers game, and you win it by removing the numbers the intruder needs. After securing the primary accounts, enable two-factor authentication on every service that offers it, even the ones you think are unimportant. A forum account that shares a password with your email is an entry point, not a dead end. The intruder will stuff credentials into dozens of services and use whichever ones open to pivot toward more valuable targets.

Use a password manager to generate and store unique passwords for every account going forward. The reuse rate drops to near zero when every service has its own 20-character random string. This is not a convenience measure. It is the single most effective defense against the entire class of attacks that follows a phishing mirror incident. The intruder cannot stuff credentials you never reused.

Watch for Address Poisoning on Crypto Services

If the compromised account had any connection to a cryptocurrency wallet or exchange, check your transaction history and address book immediately. Address poisoning is a technique where an intruder sends a tiny transaction from a wallet address engineered to look like one you have used before. The hope is that you will copy that lookalike address from your transaction history the next time you send funds and paste it without verifying every character.

Delete any unknown addresses from your address book. When sending funds, always check at least the first six and last six characters of the destination address against the one you intended. A clipboard hijacker installed during the phishing incident will replace any address you copy with an intruder-controlled one at the moment of paste. If you must send a transaction, type a small test amount first and confirm it arrived before sending the full sum.

Evidence volatility is the reason most phishing investigations stall. Chat logs vanish when a user is blocked or a room is deleted. Phishing domains go dark when the hosting account is suspended or the attacker moves on. Start preserving evidence as soon as you have secured the accounts, not after you have finished reporting. The order matters because the evidence decays faster than the reporting pipeline moves.

Save the full URL of the phishing mirror, including any subdomains and path components. Take a full-page screenshot that includes the address bar. Save the page source as an HTML file. Copy all message logs, including timestamps, usernames, and any wallet addresses the intruder provided. If the phishing mirror was reached through a link in a forum post or a direct message, screenshot that context too. Screenshots alone are weak evidence without metadata, but they are better than nothing when the original content disappears.

What Investigators Actually Need

Wallet addresses and transaction hashes are the most durable pieces of evidence because blockchain records outlive websites. Copy every address the intruder gave you and every transaction ID from your own outgoing transfers. These can be cross-referenced with other reports even months later. Email headers are the next most valuable item. If the phishing link arrived by email, save the full headers before deleting the message. Headers contain the routing information that can identify the sending infrastructure and link it to other attacks.

Do not delete anything until you have filed a report and received confirmation that it was accepted. The intruder may contact you again, and each additional message is more evidence. Takedown responsiveness from hosts and registrars depends on the quality of the evidence you provide. A report that includes the exact URL, a screenshot, and the timestamp of the phishing deployment moves faster than one that says "a fake site stole my password."

Reporting is jurisdiction-bound. File with the agency that covers your country of residence, because that is the agency that can take your statement and open a case. In the United States, that is the IC3. In the United Kingdom, it is Action Fraud. In Australia, report through ReportCyber. In Canada, the Canadian Anti-Fraud Centre is the central intake. These agencies aggregate reports and share patterns with international partners, but they cannot investigate every individual case. The victim reporting rate is low enough that your report matters even if you think the loss is too small to pursue.

Filing a report does two things. It puts your incident into the aggregate data that determines where investigative resources go, and it gives you a reference number that you can provide to your bank, your insurance company, or any other service that requires proof you reported the crime. Do not expect individual recovery. The recovery rate for darknet-adjacent fraud is low, and any service that promises to get your funds back for an upfront fee is itself a recovery scam.

Recognising the Recovery Scam That Follows

Within hours or days of a phishing incident, you may receive a message from someone claiming they can recover your lost funds or trace the intruder. This is a secondary fraud that targets victims precisely because they have already demonstrated a willingness to engage with darknet-adjacent services. The recovery scammer will demand an upfront fee for "blockchain analysis" or "investigative services" and then disappear or demand more fees. Legitimate recovery assistance does not charge upfront, does not guarantee results, and does not cold-contact victims.

If a recovery offer arrives through the same channel where the phishing link appeared, the same intruder is likely running both operations. Block the contact and include the recovery offer in your evidence file and your official report. The fee escalation count on advance-fee scams continues until the victim stops paying. Recognising the pattern after one demand saves you from a spiral.

Takedown responsiveness from hosts and registrars averages two to four days for a well-documented abuse report. During that window, the phishing mirror continues collecting credentials from every new visitor. Filing a takedown request is worth doing, but it is not the same as stopping the intruder. Takedown is not disruption. The same phishing kit will reappear on a new domain within hours, often with automated deployment scripts that require no manual effort from the intruder. Takedown recurrence is the norm, not the exception.

Report the phishing domain to the hosting provider's abuse contact and to the registrar listed in the domain's WHOIS record. Include the evidence you preserved: the exact URL, a screenshot, and the timestamp when you encountered it. Some browsers and security vendors maintain their own blocklists, and submitting the domain to them reduces the number of future victims even if the intruder re-registers elsewhere. Google Safe Browsing and Microsoft SmartScreen both accept phishing reports and feed them into browser-level warnings.

The Intruder's Infrastructure Outlasts Any Single Domain

Attribution difficulty is high because phishing infrastructure often spans multiple jurisdictions. A domain registered through a privacy-shielded registrar in one country may resolve to a hosting server in another, with the phishing kit itself loaded from a third. The intruder may be in none of those places. Law enforcement can sometimes trace these patterns, but it requires multiple reports that share the same wallet address, the same phishing kit signature, or the same email headers. Your report contributes one data point to a cluster that may eventually cross an investigative threshold.

Wallet address reuse is the strongest clustering signal. If the phishing mirror directed you to send funds to a specific address, or if an impersonator gave you a wallet to pay, that address may already be flagged in blockchain analytics tools used by exchanges and law enforcement. Reporting the address through official channels increases the chance that it will be added to those tools, which can freeze funds if the intruder tries to cash out through a compliant exchange.

After the immediate containment steps, audit every account that could be used to impersonate you. An impersonator account that looks like you can damage your reputation and defraud people who trust you long after the initial phishing incident. Check your messaging apps, social media profiles, and any forum accounts for messages you did not send or contacts you did not add. If you find an impersonator account, report it to the platform immediately and warn your contacts through a channel the impersonator does not control.

Off-platform contact is the strongest warning sign that you are dealing with an impersonation attempt. Legitimate market support, exchange staff, or service administrators do not initiate direct messages demanding payment or credentials. If a message arrived through a channel you did not initiate, treat it as hostile until proven otherwise. The lure specificity of modern phishing is high enough that the message may reference real transactions or account details scraped from a previous breach. Do not let specific knowledge convince you the source is legitimate.

Long-Term Malware Surveillance

An info-stealer or remote access trojan may remain dormant for weeks after the initial infection. Run periodic scans for the next month, even if the first scan was clean. Check your browser extensions, scheduled tasks, and startup items weekly. If your device shows unexplained network activity, high CPU usage when idle, or unexpected pop-ups, treat it as a possible reinfection. Malware persistence mechanisms are designed to survive casual cleanup attempts, and the only reliable endpoint is a clean operating system reinstall.

If you handle sensitive accounts from this device, consider it permanently untrusted until it has been wiped. The cost of a missed remote access trojan is every password you type, every session you open, and every transaction you authorise from that machine going forward. A clean install takes an afternoon. A compromised machine can drain accounts for months.