# Remote Desktop Intrusion Compromises Personal Financial Data A user discovers an unauthorized party controlling their PC and accessing sensitive banking information. - **Source:** [cybersecurity](https://brifing.si/source/57fea5eb-f11e-4b81-bc15-114313a8bd59) - **Published:** 2026-11-08 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/365aba7b-cba6-4530-a3d8-6bc764fb7a3e ## Unauthorized Remote Access Incident A user reported a shocking security breach at 5:15 AM when they discovered an unknown party actively controlling their desktop computer. The intruder accessed the user's Google profile, copied their phone number, and navigated through personal banking and email accounts while the user was physically present at the machine. ## Financial Account Compromise The intruder successfully accessed the victim's bank account, viewing savings balances and credit card details. Although the user had two-factor authentication enabled, the attacker managed to bypass security layers, likely through an active browser session. The victim immediately contacted their bank to freeze all accounts to prevent further unauthorized transactions. ## Two-Factor Authentication Bypass The victim received a two-factor authentication code just before waking up, suggesting the attacker was actively triggering login attempts. Since passwords were saved via auto-fill, the intruder did not necessarily need to know the credentials. This highlights the vulnerability of browser-based session persistence when a computer is left unattended. ## Immediate Mitigation Steps Taken The user took swift action by freezing their bank accounts and disabling the Wake-on-LAN feature in their PC settings. This specific BIOS or network setting allows computers to be powered on remotely via network packets. By disabling it, the user aims to prevent the attacker from regaining remote access while sleeping. ## Risks of Phone Number Exposure The attacker specifically targeted and copied the victim's phone number from their profile settings. This information is highly valuable for SIM swapping attacks, where criminals hijack a phone number to intercept SMS-based two-factor authentication codes. Securing the mobile account with the carrier is a critical next step for the victim. ## Digital Forensics and History The victim examined their browser search history to track the intruder's movements across their accounts. While this provided some insight into the scope of the breach, the attacker's ability to navigate the desktop suggests they had established a persistent remote connection. The user remains overwhelmed while attempting to secure their digital identity. ## Persistent Remote Access Threats Remote access trojans or unauthorized remote desktop software often remain hidden on a system even after a session ends. Simply changing passwords may not be sufficient if malicious software is installed. Users facing such breaches should consider a clean operating system reinstallation to ensure all hidden backdoors are completely removed. ## Broader Security Implications This incident serves as a stark reminder of the risks associated with leaving computers connected to the internet with active sessions. Even with two-factor authentication, session hijacking remains a potent threat. Users must prioritize hardware-based security keys and ensure that remote access features are strictly disabled when not in use. ## Sources covering this story - https://www.reddit.com/r/cybersecurity/comments/1xqxs69/i_just_woke_up_to_someone_remote_controlling_my/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._