← Resources

I Think I Clicked Something Bad, Now What?

Step-by-step guidance for what to do if you think you clicked a malicious link, opened a bad attachment, or entered your credentials somewhere you shouldn't have.

Created September 6, 2026

I Think I Clicked Something Bad, Now What?

First: you're not in trouble, and you're not the first person this has happened to. Attackers are good at their jobs, that's the whole problem. What matters now is what happens in the next few minutes, so take a breath and work through this calmly.

Step 1: Disconnect From the Network

If you're on Wi-Fi, turn it off. If you're plugged in, unplug the cable. This alone can stop a lot of damage by cutting off whatever just happened from talking back out to the internet.

Don't shut the device down. Just get it off the network and leave it as-is.

Step 2: Call the Emergency Line

Call +1 (404) 387-0435 right away, day or night. This is exactly what it's there for. Don't wait for a "good time," don't submit a ticket and wait for a callback, call.

Tell whoever picks up:

  • What you clicked, opened, or entered information into (as best you remember)
  • What device you're on
  • Anything unusual you've noticed since (pop-ups, slow performance, files you don't recognize)

Step 3: Don't Try to Fix It Yourself

It's tempting to run a scan, delete something, or uninstall a program, please don't. Well-meaning cleanup can destroy the exact evidence we need to figure out what happened and whether it spread anywhere else. Let our team drive from here.

If You Entered a Password Somewhere

If you typed your Microsoft 365 (or any work-related) password into a page that turned out to be fake, change that password from a different, trusted device, not the one you suspect is compromised. Then still call the emergency line, changing a password doesn't undo everything a compromised session may have already done.

Why Acting Fast Matters (and Why You're Already Covered)

Every managed device runs Huntress, which is often already watching for exactly this kind of follow-up activity and can isolate a device automatically. But the faster a real person on our end knows what happened, the faster we can confirm what Huntress caught, close any gaps, and make sure nothing was missed.

Reporting this immediately is never the wrong call, even if it turns out to be nothing.

Need Help?

If you run into any issues, reach out to the Triumphant support team: