Security notice: fake "security verification" box on our website
Action required if you followed on-screen commands:
If you visited our website between 1 and 18 October 2026, saw a box titled "Performing security verification", and entered Win+X, then I, then Ctrl+V, then Enter, please immediately follow the steps in the "What to do" section below using a separate, clean device.
Last updated: October 20, 2026
Between 1 and 18 October 2026, our website showed some visitors a fake "security verification" box. It was not from AutoCorrect PC. If you followed its instructions, please read the steps below.
What happened
Someone gained access to the account that sits in front of our website by using a compromised password. Two-factor authentication was not turned on, so the password alone was enough. On 1 October they added code that inserted a script into our web pages.
On Windows and Mac computers, the script could show a box titled "Performing security verification", usually after someone clicked "Confirm Email Address". The box told visitors to press Win+X, then I, then Ctrl+V, then Enter. Doing this runs a hidden command that installs software designed to steal passwords and login sessions saved in the web browser.
An independent security researcher found the problem on 18 October and told us. We removed the code the same day, at about 16:48 UTC. A detailed technical report with indicators of compromise is available for security researchers and IT teams.
Who may be affected
- You saw the box and followed its instructions on a Windows or Mac computer: your computer and the accounts saved in its browser may be compromised. Please follow the steps below.
- You saw the box and closed it without doing anything: you are unlikely to be affected.
- You only saw our normal "Email Confirmed" message, or only opened our site on a phone or tablet: you are very unlikely to be affected. The code we reviewed was aimed at Windows and Mac computers.
- You are not sure: treat it as if you followed the instructions.
What to do if you followed the instructions
Do these from a different, clean device (such as a phone or another computer), not the affected one.
- Disconnect the affected computer from the internet and stop signing in to anything on it.
- Change the passwords for everything saved in that browser. Start with your email, then banking, crypto exchanges, work accounts and social media.
- Sign out of all sessions on those accounts and turn on two-factor authentication, preferably with an authenticator app or passkey rather than SMS.
- If you use crypto wallets on that computer, move your funds to a new wallet with a new recovery phrase, created on the clean device.
- Contact your bank about any cards saved in the browser, and watch your statements.
- Back up your personal files only (not programs), then reinstall Windows or macOS. A virus scan is not enough, and antivirus software may not have detected this, so a clean scan does not mean you are safe.
- Check your email for forwarding rules or filters that you did not create.
On Windows, the PowerShell history file at %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt may show a pasted command mentioning jsdelivr or selectivewilled. This is only a hint, because the file can be cleared. A clean result does not prove a computer is safe.
We have not analysed the macOS version of this attack, so Mac users who followed the instructions should take the same steps.
Your data
AutoCorrect PC collects email addresses and names. Our review of the code the attacker added found no evidence that it copied data sent to our servers or accessed our database. We cannot completely rule out that it saw information displayed on the pages it altered, because the attacker could change what the code did at any time. Our investigation is continuing, and we will update this page if we learn more.
What we have done
- Removed the malicious code and its routes on 18 October 2026.
- Secured the account, including a new password and two-factor authentication.
- Emailed everyone who clicked our beta confirmation link during that timeframe.
- Two-factor authentication on every account we use for the website and the app.
- Alerts for any change to our website configuration, DNS records or access tokens.
- Stricter browser security settings on our pages.
- A fix for the wrong domain in the footer of our confirmation emails.
How to know a message from us is real
- We send email from the
autocorrectforpc.comdomain. - We will never ask you to run a command, download a file or "verify" your computer.
- Our security notice email contains no links or attachments. If a message about this incident asks you to click a link, treat it as suspect and come back to this page instead.
Contact us
If you have questions, or you followed the instructions and want help working out what to do, write to support@autocorrectforpc.com.
Thank you
We are grateful to Adonis Sardinas, Cyber Security Researcher and Professor of Cybersecurity at Florida International University, who found this problem, analysed it, reported it to the service providers involved, and told us quickly.
AutoCorrect PC Team
Questions or need assistance?
If you need guidance determining whether your system was affected or have questions regarding this incident, please email our support team directly. We never send email notices with file attachments or link shorteners.
Special recognition to Adonis Sardinas, Cyber Security Researcher and Professor of Cybersecurity at Florida International University, who identified this incident, performed rapid initial triage, and reported it through responsible disclosure channels.