Pause, document and preserve evidence
Do not immediately delete every suspicious file. Record the warning, preserve logs and confirm that you have a reliable backup before making major changes.
- Limit administrator access
- Change exposed credentials from a clean device
- Preserve hosting and application logs
- Check scheduled tasks and unknown accounts
- Plan cleanup and hardening together
