Clear Path step · Home · Devices that stay yours
Install only from official stores and never paste a command a website gives you
Why it matters: Fake downloads, fake 'verify you are human' pages that tell you to paste a command, and fake virus pop-ups are common ways criminals install password-stealing software. Each depends on you running it yourself.
Do it
- Install apps from the App Store, Google Play or the company's own site, found by typing the address, not from ads.
- If a web page tells you to press keys and paste something into Run, Terminal or PowerShell to 'verify', close it.
- If a pop-up says your computer is infected and shows a phone number, close the browser; if it won't close, restart.
- Turn on the browser's enhanced or strict safe-browsing protection.
Check it worked: Everyone installs apps only from official app stores or the maker's own site, ignores pop-ups with phone numbers, and never pastes a command into a computer because a web page said to.
Simply put
It's like only buying medicine from a pharmacy, never from a stranger's van. Fake downloads, fake 'prove you're human' pages and fake virus warnings all need you to run something yourself, so you simply don't.
In detail
Password-stealing malware takes saved passwords and the session cookies that keep you signed in, which can bypass MFA. If you ran something suspicious, change passwords from a different, clean device and sign out of all sessions.
If this is new to you: Already ran something odd? No panic. From a device you trust, change important passwords and sign out of other sessions, then get that computer checked before you bank on it.
Points toward the Long View: a household that never runs what a web page tells it to.