What to Do If You Accidentally Click a Malware Link

Accidentally clicking a suspicious link can happen to anyone. The important thing is not to panic or assume that one click automatically means your computer has been infected. The risk depends on what happened next: Did a file download? Did you install an app or browser extension? Did you enter a password, banking detail or verification code? Did the page ask you to call a number or give someone remote access?

Act quickly, but take the right steps in the right order. This guide explains what to do after clicking a malware or phishing link on a Windows PC, Mac, iPhone, iPad or Android device.

Quick answer: Close the suspicious page, do not enter any more information, stop any download or installation, disconnect the device from the internet if you see signs of an infection, change exposed passwords from a clean device, contact your bank if financial information was involved, and scan or have the device checked by a professional.

First, work out what happened

A suspicious link can lead to several different outcomes:

• You clicked but did not interact further. The page may have shown a fake warning, login screen or blank page. The risk may be limited, but you should still report and delete the message.
• A file downloaded. A downloaded file is not necessarily dangerous until it is opened, but do not open it. Delete it only after saving the message and file details if you may need them as evidence.
• You opened or installed something. The device may now have malware, a malicious browser extension or a remote-access tool.
• You entered a password or security code. Treat the affected account as compromised, even if nothing looks wrong yet.
• You shared bank or card details. Contact your bank or card provider immediately using a trusted phone number, such as the number on your card or statement.
• You gave a caller remote access. Disconnect the device and get help. Remote-access scams can allow criminals to view files, install software or steal credentials.

Phishing is designed to trick people into giving away information or opening content that may infect a device. It can arrive by email, SMS, social media message, QR code, phone call or collaboration platform.

What to do immediately after clicking a suspicious link

1. Stop interacting with the page

Do not enter a username, password, card number, one-time code or other personal information. Do not call a phone number shown in a pop-up, download a security tool suggested by the page or allow browser notifications.

If the page is still open, close the browser tab. If a pop-up appears to lock the screen, do not call the number. Try closing the tab with the browser controls. If necessary, close the browser using the operating system’s normal controls rather than clicking buttons inside the pop-up.

Do not return to the message to click an “unsubscribe” link or reply to the sender. CISA recommends reporting suspicious messages and deleting them rather than interacting with their links or attachments.

2. Stop downloads and installations

Check your browser’s Downloads folder. If a file downloaded, do not open, preview or run it. If you started an installer, cancel it if possible. Do not install a browser extension, mobile profile, app or remote-support program because a website told you to.

If you installed something or entered administrator credentials, move to the containment steps below. In that situation, deleting the original message is not enough.

3. Disconnect from the internet if anything looks wrong

Disconnect Wi-Fi or unplug the network cable if you notice unusual pop-ups, a locked screen, unknown programs, files changing names, a disabled security tool, unexpected remote control or rapid file encryption. Disconnecting helps reduce the chance of malware communicating with criminals or spreading across shared devices and drives.

If the device is used for work, tell your IT provider or administrator immediately. Do not reconnect it to the business network just to test whether it is working.

For a suspected ransomware event, isolate the affected device and seek urgent assistance. Computer Cures’ ransomware data recovery service explains the recovery process and the importance of preventing an infection from spreading.

4. Record what happened

Before deleting anything, write down:

• The date and time of the click
• The message, sender and website address
• Whether you entered any information
• Any file, app, extension or profile that downloaded or installed
• What device and account you used
• Any unusual pop-ups, redirects or changes

Take screenshots if it is safe to do so. Do not forward the malicious link to other people. This information can help your bank, IT provider, email provider or cybercrime reporting service understand the incident.

Secure your accounts from a clean device

If you entered a password, security answer, card number, bank detail or verification code, use a different device that you trust to secure the account. Do not change the password from a computer that may be infected.

Change passwords in the right order

Start with the account that was exposed. Then change any other account where you reused that password. Prioritise:

1. Your primary email account
2. Banking, payment and shopping accounts
3. Your Apple, Google or Microsoft account
4. Work, school and cloud-storage accounts
5. Social media and messaging accounts

Use a long, unique password for every account. Review active sessions and sign out devices you do not recognise. Check recovery email addresses, phone numbers, forwarding rules, connected apps and email filters for changes made by an attacker.

If your email may have been compromised, follow this guide on what to do if your email gets hacked. An attacker who controls your email may be able to reset other passwords and intercept security notifications.

Turn on multifactor authentication

Enable multifactor authentication (MFA), also called two-step verification, on every important account that supports it. MFA can make it harder for someone to sign in with a stolen password, although you should never approve an unexpected login prompt or share an MFA code with anyone.

If you approved a login request by mistake, revoke that session, change the password and review the account’s recent activity immediately.

Protect your money and identity

Contact your bank or card provider immediately if you entered payment details, transferred money or approved an unfamiliar transaction. Use the official number on your card or statement, not a number in the suspicious message. Ask what further steps are required, such as blocking a card, changing online banking access or monitoring transactions.

If identity documents or other personal information were exposed, keep a record of what was shared and follow guidance from the relevant organisation. Watch for unusual account-opening messages, password-reset alerts, bills or transactions.

In Australia, you can report a phishing attempt or cyber security incident through the Australian Cyber Security Centre. The ACSC also explains how to respond if you installed malware, lost money or revealed personal information through phishing.

Check the device for malware

A click alone does not prove that malware is present, and a clean-looking screen does not prove that the device is safe. Malware can be designed to remain quiet while it steals information.

On Windows or Mac

• Update the operating system, browser and security software.
• Run a full scan with a reputable, up-to-date security product.
• Review recently installed applications, browser extensions and login items.
• Remove software you do not recognise, but do not rush to delete evidence if the incident may need investigation.
• Check whether your browser homepage, search engine or notification permissions changed.
• Review unusual new user accounts, remote-access tools and security warnings.
• Change important passwords from a clean device, not from the potentially infected computer.

Common warning signs include a sudden slowdown, crashes, aggressive pop-ups, unfamiliar toolbars, changed browser settings, disabled security software, unexplained emails sent from your account or files that become inaccessible. Computer Cures lists additional signs of a virus, spyware or malware infection.

If the scan finds a threat, the device behaves strangely or you entered sensitive information, do not rely on a quick scan alone. Computer Cures can help with virus, spyware and malware removal and can check the device, repair damage and help secure it against reinfection.

On iPhone, iPad or Android

Do not install an app or configuration profile prompted by a suspicious page. Remove unknown apps, profiles and device-management settings, then update the operating system. Review app permissions, browser notifications, battery use and mobile-data use for unexpected changes.

Change account passwords from a trusted device. If you entered an Apple or Google password, secure that account first because it may control backups, email, app purchases and device access.

A pop-up saying “your phone has a virus” is not proof of infection. It is often a scare tactic intended to make you call a scammer or install an unsafe app. Use the device’s official settings and support resources instead of the pop-up’s instructions.

What not to do after clicking a malware link

Avoid these common mistakes:

• Do not panic and pay a pop-up demand. Legitimate security software does not normally require you to call a random number from a browser alert.
• Do not keep logging in to test the link. Every additional login may expose more information.
• Do not use the same password again. Reused passwords let attackers move from one account to another.
• Do not immediately wipe the device if evidence matters. Preserve details first and ask a technician or IT administrator about the safest recovery route.
• Do not reconnect a suspected infected device to shared storage. It may spread malware or encrypt accessible files.
• Do not assume antivirus alone solves a hacked account. Device cleanup and account recovery are separate steps.
• Do not trust follow-up calls or messages. Criminals sometimes contact victims after the first click while pretending to offer technical support or a refund.

Computer Cures also explains how remote-access scams work and what to do if a scammer has taken control of a computer.

If you clicked a link on a work computer

Tell your manager, IT team or managed service provider as soon as possible. Include the time of the click, the device used and any information entered. Do not hide the incident because early reporting can help protect other staff and limit access to business systems.

Your organisation may need to isolate the device, revoke sessions, reset credentials, inspect email forwarding rules, review logs, scan endpoints and check backups. Small businesses can use Computer Cures’ small business IT support for help with malware, phishing emails, backup failures and cybersecurity protection.

A backup is useful only if it is available, separate from the infected system and tested. After the incident, review your cloud backup and storage setup so important files can be restored without paying criminals.

How to prevent the next accidental click

No single tool blocks every scam. Combine safe habits with technical protection:

• Pause when a message creates urgency, fear or excitement.
• Check the sender address and the real link destination before opening it.
• Avoid shortened or unexpected links.
• Go to a company’s website by typing its address or using a saved bookmark rather than using a message link.
• Confirm unusual requests through a separate channel.
• Keep operating systems, browsers, apps and security tools updated.
• Use unique passwords stored in a reputable password manager.
• Enable MFA on email, banking, cloud and social accounts.
• Back up important files and test restoring them.
• Use spam filtering and security controls on business email.
• Teach family members and staff what phishing looks like, including realistic AI-written messages.

CISA highlights urgency, requests for personal or financial information, shortened URLs and slightly altered addresses as common warning signs. It also notes that perfect spelling is no longer a reliable sign that a message is genuine.

When to call a professional

Get professional help promptly if you installed software, entered administrator credentials, gave remote access, exposed banking details, lost access to an account, see ransomware symptoms or cannot confirm that the device is clean.

Computer Cures provides same-day computer repair and IT support across Melbourne, including malware removal, hacked-account assistance, data recovery and business support. You can contact Computer Cures or call 13 0055 3166 to discuss what happened.

The most important step is to act early. A mistaken click is a problem to investigate, not a reason to freeze. Stop interacting with the link, protect your accounts, isolate the device when necessary and get trusted help if anything is unclear.